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SECTION I. 

GENERAL 

Paragraph 



Introductory remarks concerning transposition ciphers 1 

Basic mechanism of transposition ciphers 2 

Monophase and polyphase transposition 3 



1. Introductory remarks concerning transposition ciphers. - a_. 

As stated in a previous text, transposition ciphers are roughly 
analogous to "jig-saw puzzles" m that all the pieces of which the 
original is composed are present but are merely disarranged. The 
pieces into which the picture forming the basis of .a jig-saw puzzle 
may be divided are usually quite irregular in size and shape, the 
greater the amount of irregularity, as a rule, the greater the dif- 
ficulty in reassembling the pieces in proper order. In this respect, 
too, transposition ciphers are analogous to jig-saw puzzles, for 
the greater the amount cf distortion to which the plain text is 
subjected in the transposition process, the more difficult becomes 
the solution. 

Is. In jig-saw puzzles there is usually nd regularity about 
the size of the individual pieces into which the original picture 
has been cut, and this feature, of course, materially contributes 
to the difficulty in reconstructing the picture. There are, to be 
sure, limits (dictated by considerations of practicability) which 
sorve to prevent the pieces being made too small, for then they 
would bocome unmanageable; on the other hand, there are also 
limits which must be observed in- rosyoct to the up t er magnitude of the 
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> pieces f for if they are made too large the puzzle becomes too easy 
to solve. These features of jig-saw puzzles also have their 
analogies in transposition methods. In the latter, if the textual 
units- to be subjected to transposition are made quite large, say 
entire sentences, the difficulties a cryptanalyst will have in re- 

t 

constructing the text are practically nil; on the other hand, if 
these textual units are made quite small, even smaller than single 
letters^, then the reconstruction of the transposition text by a 
cryptanalyst often becomes a very difficult matter. In between 
these two extremes there may bo various degrees of fragmentation, 
limited only by considerations of practicability. 

c. It is fortunate, however, that the cryptanalyst does not, 
as a rule, have to contend with problems in which the size of the 
textual units vanes within the same message, as is the ca3e in jig- 
saw puzzles. It is perhaps possiblo to devise a transposition 
system in which the text is divided up in such a manner that entire 
sentences, whole words, syllables, individual letters, and fractions 
of letters form the units for transposition; but it is not difficult 
to imagine how impractical such a scheme would be for regular com- 
munication, and it may be takon for granted that such irregularity 

in size of textual units will not he encountered m such communication 

t 

i 

d. The days when the simple methods of word or letter trans- 
position were sufficient- for military purposes have long since 

/ r. 

^Reference is here made to so-called fractionating systomB. See 
Special Text No. 166, Advanced Military Cryptography , Sect. XI* 
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passed by, and it is hardly to be expected that cryptograms of such 
ineffectual nature will be encountered in the military communications 
of even the smaller armies of today. However, in time of emergency, 
when a counter-espionage censorship is exercised over internal com- 
munications, it is possible that isolated instances of simple 
transposition may be encountered. The solution of such cases should 
present no difficulties, unless numerous code names and nulls are 
also used in the cryptograms. Mere experimentation with the crypto- 
grams, trying various sizes of rectangles, will usually disclose the 
secret text. If code names are usod and the context gives no clue 
to the identity of the persons or places applicable, it may be 
necessary to wait until additional messages become available, or, 
lacking such a possibility, there is usually sufficient justification, 
under the exigencies of war, to campol the correspondents to reveal 
tho meaning of these code names. 

e. Although transposition ciphers, as a general rule, are 
much less complex m their mechanics than arc substitution ciphers, 
tho cryptanalyst usually experiences a feeling of distaste and dismay 
when confronted with unknown ciphers of this category. There are 
several reasons for his aisliko for them. In tho first place, 
although transposition ciphers are admittedly lose intricate than 
substitution ciphers, as a general rule there are not nearly so many 
cryptanalytic tools and "tricks” to be used in the solution of the 
foraier as there are in the latter, and therefore the montal stimulus 
and satisfaction which the cryptanalyst usually derives and regards 
as part of the reward for his hard labor in solving a cipher is often 
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missing in the case of transposition ciphers. In the second place, 
despite their lack of complexity, the solution of transposition 
ciphers often involves a tremendous amount of time and labor most of 
which commonly turns out 'to be fruitless experimentation. Thirdly, in 
modern military communication transposition methods are usually not 
employed alone but in conjunction with substitution methods — and 
then the problems may become difficult indeed, for usually before the 
substitution can be solved it is necessary to uncover the substitutive 

text by first removing the transposition. Finally, in working with 

. , ' 

transposition ciphers a much higher degree of accuracy in mere 
mechanical operations Is required than m working with substitution 
ciphers, because the accidental omission or addition of a single 
letter will usually necessitate rewriting entire messages and start- 
ing afresh. Thus, this sort of work calls for a constant state of 
concentrated attention, with its resulting otito of mental tension, 
which takes its toll in mental wear and toar. 

2 . Basic mechanism of transposition ciphers. - a. Basically 
all transposition ciphers involve at least two processes: ( 1) writing 
the plain-text units (usually single letters) within a specific 
regular or irregular two-dimensional design, in such a prearranged 
manner that the said unit3 are distributed regularly or irregularly 
throughout the various' colls or subsections of that design; (2) re- 
moving the plain-text units from the design in such a prearranged 
manner as to change the original sequence in which they followed one 
another in the plain text, thus producing cipher t'oxt. Since the 
first process consists of inscribing the text within the design, it is 
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technically referred to as the process of inscription ; and since the 
second process consists of transcribing the text from the design, it 
is technically referred to as .that of transcription . Either or both 
processes may be repetitive, by prearrangement of course, in which 
case the inteimediate steps may be referred to as processes of 
rescription, or rescrjptive processes. 

b_. It is hardly necessary at this point to give the student any 
indications as to how to differentiate a transposition from a sub- 
stitution cipher. If a review is nocessary, however, he is reforred 
to Section IV of Military Cryptanalysis, Part I. 

3. Monophase and polyphase transposition. - a. As may be 
inferred from the foregoing definitions, when a transposition system 
involves but a single process of inscription, followed by a single 
process of transcription, the system may be referred to as monophase 
transposition , caimaonly called single transposition . When one or more 
rescriptive processes intervene between the original inscription and 
the final transcription the system may be reforred to as polyphase 
transposition . As a general rule, the solution of the latter type 
is much more difficult than the former, especially when tho trans- 
positions are theoretically correct in principle. 

b_. Any system which is suited for monophase transposition is 
also usually suited for polyphase transposition, tho processes of 
inscription, roscrjption and transcription being accomplished with 
the same or with different keys. 
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SECTION II 

, 'SOLUTION OF SIMPLE TRANSPOSITION CIPHERS 

_ Paragraph 

Simple types of transposition 4 

The principles of solution of uniliteral route transposition 

ci phers ... 5 

Keyed columnar transposition with completely-filled rectangles . 6 

Example of solution .\ 7 

The probable-wcrd method of solution ....;. .. 8 

General remarks on solution 9 

Reconstruction of literal key * 10 

Column and row transposition 11 

4> Simple types of transposition. - a. The simple cases of 
reversed writing, vertical writing, or rail fence writing hardly' 
require serious attention, since they may bo solved almost by inspec- 
tion. These methods are included hore only because they may be en- 
countered in censorship operations. 

b_. Tho lov, dc.^ree of cryptographic security afforded by those 
mothods may be increased to a slight dogreo by adding nulls or by dis- 
guising the original word lengths, and regrouping into false words or 
into groups of regular length. 

c. Some examples of the3o simplest types of transposition 
follow. Lot the message be: BRIDGE DESTROYED AT EiuEVEN PM. 

(1) Reversing only the words and retaining original word 

lengths : 

Cipher ..EGDIRB DEYORTSED TA NEVELE M? 

(2) Reversing only tho words and regrouping into false word 

lengths : 

Cipher ..^EG DIRB DEYORT SEDTA NEVE LEMP 

(3) Reversing tho whole text and regrouping into fives: 

Cipher . . M P N E V EL ETA DEYOR TSEDE GDIRB 



- 6 - 
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(4) Reversing the whole text.iregrouping into fives, and 
inserting a null in every fifth position: 

Cipher . . T R I M M PNEVP E L E T A ADEYR ORTSL 
EDEGU DIRBM 



(5) Writing the text vertically in 


B S 


B R 




R T 


I D 


two columns and taking the resulting digraphs 


I R 


G E 


D 0 


D E 


for the cipher text, as shown at the side. 


G Y' 


S T 




E E 


R 0 


The cipher message becomes: 


D D 


Y E 


BSRTI RDOGY EE DDE ,or 

BIGDS RYDRD EETOE 


E 


D 



These simple types can be solved merely by inspection. 

5. The principles of solution of uniliteral route transposition 
ciphers. - a. The so-called uniliteral route transposition methods^ 
are next to be examined. The solution of cryptograms enciphered by 
these methods is a matter of experimenting with rectangles of various 
dimensions suggested by the total number of letters m the message, 
then inspecting these rectangles, searching for whole words or the 
fragments of words by reading horizontally, diagonally, vertically, 
spirally, and so on. 

b. The amount of experimentation that must bo performed in the 
solution of ciphers of this type may be materially shortened by means 
of formulae and tables constructed for the purpose. But because 
ciphers of this type are of infrequent occurrence today, these 

^See Special Text No. 165 , Elementary Military Cryptography , 1935* Rars. 

20 , 21 . 
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formulae and tables are only occasionally useful and hence they 
have been placed in an appendix to This volume. 

6. Keyed columnar transposition with completely-filled 
rectangles. - a. In practical cryptography, the dimensions of the 
transposition rectangle, as a general rule, cannot vary between large 
limits; that is, it can be assumed in. practice that rectangles based 

l 

upon lines of writing containing less than 5 letters or more than 25 
letters will not commonly be encountered. If the width, that is, the 
number of columns, is determined by a key, Then the number of rows 
becomes a function of the length of the message to be enciphered. If the 
latter is vexy long, longer than can be conveniently handled without 
too many errors, it is a common practice to break up a message into 
two or more parts and treat each port, as though it were a separate 
communication. 

1). When the last row of a transposition rectangle is completely 
filled, the solution of the resulting cryptogram is considerably more 

Q 

simple than when this is not the. case. Consequently, this will be 
the first case to be studied. 

c. In solving a cryptogram of this type the first stop taken .by 
the cryptanalyst, is to ascertain the dimensions of the rectangle. Clues 

i 

for this are usually afforded by finding the factors of the total 
2 

See Appendix 1. 

3 

■'See Special Text No. I 65 , Elementary Military Cryptography, 1935 » 

Sec. V. 
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number of letters in the cryptogram. Suppose the cryptogram contains 
152 letters. The dimensions of the transposition rectangle may be 
4 x 38 1 8 x 19, by which is meant that four hypotheses may be made 
with respect to its dimensions. The rectangle may consist of: 

(1) 4 columns with 38 rows, or 

(2) 3 8 columns with 4 rows, or 

(3) 8 columns with 19 rows, or 

(4) 19 columns with 8 rows. 

In practical work it is rather unlikely to encounter a rectangle that 
conforms to hypothesis (1) or (2), and for the present these may be 
discarded. As to choosing between hypotheses (3) and (4)» a rather 
simple test will disclose which is the more likely to be true. 

d. It is obvious that if the cryptogram is transcribed within a 
rectangle of the correct dimensions, the letters m oach row will be 
the ones which actually were in those rows in the original transposition 
rectangle and formed good plain text therein. In fact, the rows of 
letters in the correctly-dimensioned rectangle would read plain text 
were it 'not for the transposition which they have undergone within the 
rows. Therefore, the rows of a correctly-dimensioned rectangle are 
more likely to manifest the expected vowel- consonant proportions of 
normal plain text than are the rows of an incorrectly-dimensioned 
roctangle, because in the latter case there are brought into same of 
the rows letters which belong to other row3 and which are likely to 
disturb the normal vowel- consonant proportions of plain text. That is, 
in an incorrectly-dimensioned rectangle some of the rows will have too 
many consonants and not enough vowels, in other rows this relationship 
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will be reversed; whereas in a correctly-dimensioned rectangle each 
row will have the proper number of vowels and consonants. Hence in 
solving an unknown cryptogram of this type, if a count is made of the 
vowels and consonants in the rows of rectangles of various probable 

t 

dimensions, that rectangle in which the rows show the best distribution 
of vowels and consonants is most likely to be the correctly-dimensioned 
one, and the one that should be tried first. 

£. Having ascertained the correct dimensions of the rectangle by 
the foregoing procedure, the next step is to experiment with the 
columns of the rectangle, trying to bring together several which will 
show good digraphs, trigraphs, or polygraphs in the rows thereof. 

This process of combining or matching columns in order to build- up 
these fragments of plain text will heroin be referred to as anagramming .^ 



^fhe Standard Dictionary defines the word anagram as follows: "(noun) 

1. The letters of a word or phrase so transposed as to make a dif- 
ferent word or phrase; as, ’time* and ’mite* are anagrams of ’emit*. 

2. A transposition; interchange." As a verb, it is defined as "to 
anagrammatize; to make an anagram of; make anagrams." (The construc- 
tion of anagrams was a very widespread pastime in previous centuries. 
See Wheatley’s Of Anagrams. London, 1862.) A strict interpretation of 
the word would therefore confine it to cases wherein the letters to be 
rearranged already form bonafide words or intelligible phrases. How- 
ever, this would hardly be broad enough, for cryptanalytic purposes. 

As used in cryptanalysis the word is commonly employed as a verb to 
refer to' the process of rearranging the disordered letters of cipher 
text so as to reconstruct the original plain text. 
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The procedure is to select a column which has a good assortment of 
high-frequency letters and find another column which may be added 
before or after the selected column to build up high-frequency 
digraphs; when such a pair of columns has been found, attempt is made 
to add another column before or after this pair to build up high- 
frequency trigraphs, and so on, gradually building up longer and longer 
polygraphs until entire words begin to appear m the various rows of 
the rectangle. In this process of anagramming advantage may be taken 
of such simple mathematical considerations as adding the normal plain- 
text frequency values of the digraphs in the col umns to assist in dis- 
carding combinations which are on the borderline of choice. Once a set 
of four or five columns has been correctly assembled it is usually the 
case that the process may be completed very quickly, for with the 
placement of each column the number of remaining columns possible for 
selection diminishes; toward the close of the process, when only two 
or three columns remain, their placement is almost automatic. 

f. It is desirable as a final step to try to reconstruct, if 
possible, the literal key from which the numerical transposition key 
was derived. 

7. Examplo of solution. - ia. Given the following cryptogram, 
the steps in solution will be set forth in detail: 

CRYPTOGRAM [126 letters) 

ILHHD TIEOE UDHTS ONSOO EEEEI OEFTR 

RHNEA TNNVU TLBEA EDEOY CAPDT RRIIA 

RIVNL R N R Vi E TUTCU VRAUO OOF DA ONAJI 

UPOLR SOMTN FRANF MNDMA SAFAT YECFX 

R T G E T A 



- 11 - 
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b. The cryptogram contains 126 letters and the factors of 126 
are 2, 3, 7, 9, 21, suggesting rectangles 7 z 18 or 9 x 14* If "the 
former dimensions are taken, the rectangle may have 7 columns and 18 
rows or 18 columns and 7 rows; if the latter dimensions are taken, it 
may have 9 columns and 14 rows or 14 columns and 9 rows. In making the 
vowel* consonant test described in Far. 5&,» it is advisable to make the 
count on the columns as well as the rows of a rectangle, since it is 
possible that the cryptogram was prepared by inscribing the plain text 
in rows and transcribing the text from the columns, or vice versa . 

After examining a rectangle both horizontally and vertically, it is 
often possible to discard various arrangements without further tests. 

For example, Fig. la shows a rectangle of 7 columns and 18 rows. Now in 
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7 x 18 



Wo. of 
vowels 





1 2 3 4 5 6 7 


1 


I 0 N T T U M 


2 


L 0 N R 0 P A 


3 


H E V R U 0 S 


4 


H E U I V L A 


5 


D E T I R R F 


6 


I E L A A S A 


7 


IIBRUOT 


8 


E 0 F I 0 M Y 


9 


0 E A V 0 T E 


10 


E F E N 0 N C 


11 


tJ T D L F F F 


12 


D R F R D R X 


13 


S R 0 N A A R 


14 


1HYR0BT 


15 


S N C W N F G 


16 


OEAEAME 


17 


SAPTJHT 


18 


S T D U I D A 




7 1 6 6 D 4 7 



Vi o 
°H 

• Is 



fi 

I 



No. of 
vowels 



18 x 7 



123456739 X) 3L 32 33 11 35 3617 B 



1 [ESETTBY 
2L00ERNFC 
3 IENERNAA 
4 IUSIHVEP 
5 DDOONUDD 
6riI0EETFT 
7 IITEFALQR 
2 4462132 



R N T A A P 
ILUUOO 
IHTOHL 
A N C 0 A R 
R R U 0 J S 
I * V F I 0 
V E R D U M 



T M F X 
N N A R 
F D T T 
R M Y 0 
A A E E 
W S C T 
F A F A 



4 1 2 5 5 2 

b 



12 3 2 



No. of 
vowels 




9 F3H12B 34 



U N & C 
P F A I 
ORBS 
L A A B 
E/JF1 
S F A G 
0 U T 1 10 
HBYI 6 
T D E A| 8 
3 15 2 



Vi m 
o H 



& e 



6 

3 

3 
7 

4 
4 



FIGURE 1 



No. of 
vowels 
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l 

1 

a row of 7 letters there should be (7 x 40 $ = 2.8) either 2 or 3 
vowels; but rows 12 and 15 contain no vowels at all and rows 8 and 9 
contain 5 vowels, row 16, 6 vowels. It is concluded at once that this 
arrangement is highly improbable . If the plain text -had been inscribed 
vertically in this same rectangle, and then the rows had been trans- 
posed in forming the cipher text, then in each column (18 letters) 
there should be (18 x 40 # - 7*2) about 7 vowels; but column 2 contains 
11' vowels and column 6 only 4* This likewise indicates that it is 

V. 

highly improbable that the message was inscribed vertically and the 
cryptogram foimed by transposing the rows. But when the arrangement 
in Fig. lb_ is studied, lb is not so easy to say at once that it is 
improbable . For in 18 letters there should be about 7 vowels and none 
of the rows of this arrangement shows too great a departure from this 
expected number. This possibility win have to be explored further and 
it is for the moment put aside. If it bo assumed that the message' was 
inscribed vertically in the rectangle 18 x 7 end the rows subjected to 
transposition, there should be (7 x 40 % = 2.8) 2 or 3 vowels in each 
column. But since .several of the columns show rather considerable 
departures from this expected number, it may be concluded that a 
vertical inscription and horizontal transposition is not probable and 

- i 

this assumption may be eliminated. Then the arrangements in Fig. l£ 

i 

and id are studied in 'the same manner, with the result that at the end 
of the 3tudy the situation as regards the various assumptions i3 sum- 
marized as follows: 
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Rectangle 7 x 18 
7 columns and 18 rows: 

( 1 ) Horizontal inscription, columnar transcription .... Very Improbable 

( 2 ) Vertical inscription, horizontal transcription .... Very Improbable 

18 columns and 7 rows: 

( 3 ) Horizontal inscription, columnar transcription Possible 

( 4 ) Vertical inscription, horizontal transcription Improbable 




Rectangle 9 z 14 
9 columns and 14 rows: 

( 5 ) Horizontal inscription, columnar transcription Possible 

(6) Vertical inscription, horizontal transcription Improbable 

14 columns and 9 rows: 

( 7 ) Horizontal inscription, columnar transcription Improbable 

(8) Vertical inscription, horizontal transcription .... Very Improbable 

c. Discarding all assumptions except (3) and ( 5 ), the latter are 
subjected to further scrutiny. Suppose the average amount of deviation 
from the expected number of vowels in each row is calculated by finding 



the difference between the actual and expected numbers in each row, 
adding these differences {neglecting signs), and dividing by the total 
number of rows. For assumptions (3) and ( 5 ) the results ^jre as follows: 



12 x 7 



£ 

4-1 

o 



1 2 3 L 5 6 7 8 9 10 11 12 13 14 15 16 17 IS £ 



g ,£ 

•H H 
+» m 
a) _ 0 

> 00 

& 4h p. 



1 


I 


E 


S 


E 


T 


T 


B 


Y 


R 


K 


" 7 " 


“3T 


T 


"T 


T 


M 


~T~ 


T 


6 


1.2 


2 


L 


0 


0 


E 


R 


N 


F 


C 


I 


L 


U 


tJ 


0 


0 


N 


N 


A 


R 


9 


1.8 


3 


H 


E 


N 


E 


R 


N 


A 


A 


I 


E 


T 


0 


N 


L 


F 


D 


T 


T 


6 


1.2 


4 


H 


TJ 


S 


I 


II 


V 


E 


P 


A 


II 


C 


0 


A 


R 


R 


li 


Y 


G 


7 


.2 


5 


D 


D 


0 


0 


N 


TJ 


B 


D 


R 


R 


u 


0 


J 


S 


A 


A 


E 


E 


9 


1.8 


6 


T 


II 


0 


E 


E 


n. 


F 


n 


I 


V? 


V 


F 


I 


0 


N 


S 


C 


T 


6 


1.2 


7 


i 


T 


3 L 


F 


A 


L 


0 


R 


V 


E 


R 


D 


U 


M F 
Total 


A F A 
deviation 


8 


.8 

8.2 




























Average 


deviation 


= 


1.2 



FI GORE lb_. 



V 
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1 


2 


_JL 


Jl 


SL 

5 


xjA 
6 7 


8 


_9 


> 

£ 

u 

o 

m 

g 


Deviation 

expected 


1 


I 


S 


T 


B 


R 


T 


A 


T 


F 


2 


1.6 


2 


L 


0 


R 


F 


I 


U 


0 


■N 


A 


5 


1.4 


3 


H 


N 


R 


A 


I 


T 


N 


F 


T 


2 


1.6 


4 


H 


S 


H 


E 


A 


C 


A 


R 


Y 


4 


• 4 


5 


D 


0 


N 


D 


R 


U 


J 


A 


E 


4 


■ 4 


6 


T 


0 


E 


-F 


I 


V 


I 


N 


C 


4 


•4 


7 


I 


E 


A 


0 


V 


R 


U 


F 


F 


5 


1.4 


8 


E 


E 


T 


Y 


N 


A 


P 


M 


X 


4 


• 4 


9 


0 


E 


N 


C 


1 


U 


0 


N 


R 


4 


•4 


10 


E 


E 


N 


A 


R 


0 


~L 


D 


T 


4 


• 4 


ll 


U 


I 


V 


P 


N 


0 


R 


M 


Or 


3 


.6 


12 


D 


0 


U 


D 


R 


0 


S 


A 


E 


5 


1.4 


13 


H 


E 


T 


T 


W 


F 


0 


S 


T 


2 


1.6 


14 


T 


F 


L 


R 


E 


D 


M 


A 


A 


3 


.6 












Total 


deviation 


- 


12^ 



Average deviation = .9 



■* 



FIGURE lc_. 

The average amount of deviation for assumption (5) i3 only .9 as 
against 1.2 for assumption (3); therefore the former assumption is 
considered to he somewhat better than the latter and it will be tried 
first. 

d.. The columns of the rectangle shown m Fig. lc are now to 
be cut apart and the procedure of anagraming applied. (For this it is 
best to have the cryptogram written on cross-section paper preferably 
with l/2-inch squares for ease in handling. ) Consider column 7, with 
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the letter J in row 5i thi3 letter, if it is a part of a word, must 
be followed by a vowel, which eliminates columns 1, 3* 4, and 5 us 
possibilities for placement on the right of column 7* Here are the 
digraphs formed by combining column 7 with 2, 6, 8 and 9, and the 
totals obtained by adding the frequency values of the digraphs: 5 



(1) 


•8 a 


o' 

(2)g § 


(3)g § 




( 4)8 § 






ig 


ig 


3g 




33 


2=1 




r 


2± 1^ 


2=1 fi* 


2=1 l > 


A S 


- 


41 


A T - 47 


A T - 47 


A 


F - 4 


0 0 


- 


6 


0 U - 37 


o N - 77 


0 


A - 7 


N N 


- 


8 


N T - 82 


N F - 9 


N 


T - 32 


A S 


- 


41 


A C - 14 


A R - 44 


A 


Y - 12 


J 0 


- 


2 


J U - 2 


J A - 1 


J 


E - 2 


I 0 


- 


41 


I v - 25 


I N - 75 


I 


C - 22 


U E 


- 


11 


U R - 31 


U F - 1 


U 


F - 1 


P E 


- 


23 


P A - 14 


PM- 4 


P 


X - 0 


0 E 


- 


3 


0 U - 37 


0 N - 77 


0 


R - 64 


L E 


- 


37 


L 0 - 13 


L D - 9 


L 


T - 8 


R I 


- 


30 


R 0 - 28 


R M - 9 


R 


G - 7 


S 0 


- 


15 


S o - 15 


S A - 24 


S 


E - 49 


0 E 


- 


3 


0 F - 25 


0 S - 14 


0 


T - 19 


M F 


- 1 


M D - 1 


U A - 36 


M 


A - 36 


Totals 


262 


371 


427 




313 



FIGURE 2. 



Combination (3) gives the highest frequency value for the digraphs 
and an attempt is made to add a column to it. Here aro some of the 
combinations tried: 



e 

v The frequencies shown are as given in Table 6, Appendix to Military 
Cryptanalysis, Part I . The totals obtained by addition of the fre- 
quency values of the digraphs should be considered only as rough 
approximations or guides in weighing probabilities m favor of one 
hypothosis against another, for theoretically the probability of the 
simultaneous occurrences of two or more independent events is the product, 
and not the sum, of their respective probabilities. However, m this case 
the calculation of the products would involve an amount of labor entirely 
unwarranted by the results to be expectod, so that a simple addtion of 
the probabilities is considered sufficient. 
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7-8-1 


7 - 8-2 


7 - 8-3 
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0 


N 
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L 
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HI 
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M 


A 


T 
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A 
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FIGURE 3 

<a. Each of these combinations shows at least one "impossible" 
trigraph ,and several "poor" ones . ^ After more or less work along 
these lines, the cryptanalyst begins to get the feeling that "something 
is wrong," for, a 3 a rule, once a correct start has been made xn cases 
of this kind, solution comes rather quickly. Hence, the cryptanalyst 
decides here that possibly his first choice of combination ( 3 ) was a 
bad one, even though it gave the greatest total when frequency values 
for the digraphs were summed. The second greatest total was for 
combination (2), in which columns 7 and 6 were put together.' The in- 
frequent digraph JU suggests a word such as JUST or JUNCTION. If it 

v 

were the former there should be a column containing an S in the 5th row, 
and there is no such column. If the word is JUNCTION, there should be 
a column containing an N in the 5th row, and bhere is only one such 



^Following the steps taken in subparagraph d, frequency weights may 
be given the various trigraphs in Fig.. 3 and the sums obtained taken 
as indications of the relative probability of each of the four trials. 
These steps are here omitted, for they are obvious. 




REF ID : A56913 



column, the 3d. Placing column 3 after column 7" 6 gives the trigraphs 
shown in Fig. 4* All of these trigraphs are excellent except the 
last, and that one may be either an abbreviation of a signature, or 
possibly nulls added to complete the rectangle. If the word JUNCTION is 
correct then there should -be a column with a C in the Jth row; but none 
is found. However, column 9 has a C in the 6th row, and if it happened 
that the last column on the right is number 3» then column 9 would be 
the 1st column. Thus, as shown in Fig. 5, the arrangement of columns 
becomes quite definite: 



7-6-3 9-?-?-?-?-?-7-6-3 9-1-5-2-8-4-7-6-3 

; 

ATT F ATT FIRSTBATT 

OUR A OUR ALIONFOUR 

NTR T NTR TKINFANTR 

ACH Y ACH YHASREACH 

JUN E JUN EDROADJUN 

IVE C IVE CTIONFIVE 

URA F URA FIVEFOURA 

PAT X PAT XENEMYPAT 

OUN R OUN ROLENCOUN 

LON T LON TEREDALON 

ROV Gr ROV GUNIMPROV 

SOU E SOU EDROADSOU 

OFT T OFT THWESTOFT 

MDL A M D L ATEFARMDL 

FIGURE 4. FIGURE 5* FIGURE 6. 



f. It is believed that the procedure has been set forth with 
sufficient detail so as to moke further demonstration unnecessary. The 
rectangle can be completed very quickly and is found to be as shown 
in Fig. 6. ■ 

8. The probable-word method of solution. - a. The probable-word 
method of attack is as important in the solution of transposition 
ciphers as it is mthe solution of substitution ciphers, and if the 
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cryptanalyst is able to assume the presence of such probable words as 
are usually encountered in military communications, the solution, as a 
rule, comes very quickly. 

b . As an illustration, looking at the first row of letters in 
the rectangle shown in fig. l£, the letters ISTBRTATF almost 
at once suggest FIRST BATTALION as the initial words of the message. A 
rearrangement of the columns of the cryptogram to bring the necessary 
letters into juxtaposition at once discloses the key. Thus: 

9-1-5-2-8-4-7-6-3 
FIRSTBATT 
A L I 0 N 

It will be noted that this assumption requires that there be a column 
headed by FA, another headed by XL, another headed by RI, and so on. 

Had such columns not been found, than the word BATTALION would not be 
possible. In that case the word FIRST would still remain as a point 
of departure for further experimentation. 

c_. In the foregoing illustration, the probable word was assumed 
to appear in the first line of text in the rectangle. If the probable 

p 

word being sought is in the interior of tho message, the steps must be 
modified somewhat but the basic principle remains unchanged. The 
modifications are of course obvious. 

9*. General remarks on solution. - a. In solving transposition 
ciphers advantage should be take'n of all the characteristics and 
idiosyncrasies which are peculiar to the language of the enemy, because 
they often afford clues of .considerable assistance to the cryptanalyst. 
In all languages there are certain letters, usually of medium or low 
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frequency, which combine with other letters to form digraphs of high 
frequency. For instance, in English the letter H is of medium 
frequency, but it combines with T to form the digraph TH, which is of 
highest frequency in literaxy text; it also combines with C, a letter 
of medium frequency, to foim the fairly frequent digraph CH. The 
letter V is almost in the low-frequency category yet it combines with 
E to form the digraph VE, which in military text is the 14th in 
frequency. The low-frequency letter K often combines with C to foim 

the digraph CK. Consequently, in working with transposition ciphers 

/ 

in English, when there is an H, attempts should be made to combine it 
first with >a T, or with a C; a V should be combined first with an E; 
a K should be combined first with a C; and so on. 

b. There is usually in every, language at least one letter 
which can he followed by only a certain other letter, forming what may 
be termed an obligatory sequence, or an invariable digraph . In all 
languages having the letter Q, the combination Cp constitutes such an 
invariable digraph. ^ In genuine word3 of the German language the 
letter C is nevor used by itself, when present the letter C i3 
invariably followed by an H, except on rare occasions whon the digraph 
CK is employed. In English, the letter J con be followed only by a 
vowel; tho letter X can only bo precoded by a vowel and, except at the 
end of a word, con only be succeeded by a vowel, and so on. Letters 

7 

The letter Q, may, of course, be part of an abbreviation, such as SQ, 
for "square", or it may be used as a null, or as a sign of punctuation. 
However, unless there are good reasons for believing that this letter is 
used for these purposes, QJJ may be considered to be an invariable 
digraph. ■ 
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which behave in this maimer, that is, letters which have what nay be 
called a limited affinity in combining with other letters to form 
digraphs, constitute good points of departure for solution and are 
therefore of sufficient importance to warrant their being designated 
by the more or less descriptive name of pilot letters . 

£. The presence of pilot letters in a transposition cipher 
often forms the basis for the assumption of probable words. Obviously, 
a special lookout should be kept for words of rather high frequency 
(in military correspondence) which contain letters of low or medium 
frequency. The frequent word CAVALRY, for example, would suggest it- 
self if the cryptogram has the letters C, V, L, and Y, vdiich are all 
of medium frequency. The important word ATTACK suggests itself if the 
cryptogram has a K, a letter of low frequency and a C, one of medium 
frequency; and so on. 

cl. The mechanics of simple columnar transposition make possible 
the production of rather long sequences of vowels and long sequences of 
consonants in the text of the cryptogram. Note, for example, in the ^ 
cryptogram on p. 11, the sequence of vowels OOEEEEIOE, and the 
sequence of conaonants V N L R N R W. If the enciphering or plain- 
text rectangle is consulted, it will be seen That these two sequences 
belong together, that is, they are in adjacent columns in that rectangle. 
It Is a characteristic of plain text that conscnant-vowel or vowel- 
consonant digraphs are much more frequent than consonant- consonant or 

a 

vowel-vowel digraphs, and Therefore when long sequences of consonants 



ie CV and VC digraphs constitute about 62 per cent of all digraphs 
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and of vowels are found in transposition ciphers, a good start toward 
solution may result from assuming that such sequences come from 
adjacent columns. 

e . It should, however, he noted in connection with tell-tale 
letters such as Q (entering into the composition of QU) and C (entering 
into the composition of OH), that astute cryptographers who realize the 
clues which such letters afford often replace the invariable sequences 
they form by a single character, usually one that is rarely used in the 
language in question. For example, CH in German may be replaced by 

Q, QU in French, by K, and so on. When this is done, solution is made 
more difficult; but only in those cases where it is dependent upon 
finding letters forming obligatory sequences in plain text doe3 this 
sort of subterfuge become a factor of importance. 

f . The presence of many Q*s, or K's, or X's in a transposition 
cipher should not, however, be taken as prima facie evidence of the 
type of replacement noted in the preceding subparagraph. It is possible 
that such letters may be used as sentence separators or other punctua- 
tion, or possibly they may bo nulls, although the alert cryptographer 
would either use nulls not at all or, if he had to, would use letters of 
medium or high frequency for this purpose. 

£. Because it is important that the cryptanalyst take advantage 

of every peculiarity specifically applicable to a cryptogram to be 

■ 

solved, especially as regards the presence of low-frequency lstters, it 
is advisable that a umliteral frequency distribution be prepared, 
just as though he were going to deal with a substitution cipher. This 
is probably the quickost way of bringing to light the peculiarities 
which may be helpful in solution. 
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10. Reconstruct ion of literal key. - a. The reconstruction or 
recovery of the literal key from which tho numerical transpbsition key 
was derived is naturally the last step in the solution of cryptograms 
of this type. It is often of more than merely academic interest, 

because if it is found that the enemy .is employing for this purpose 

■ 

words or phrases of a simple nature associated with the locale of 
operations this fact may he of Importance in subsequent work. 

]b. In this process there are only a few guiding principles to be 
noted and much must be left to the ingenuity and imaginative powers of 
the cryptanalyst. Taking as an example the numerical key uncovered in 
the solution of the cryptogram in Par. 7, the procedure will be set 
forth below. 

£. The numerical key referred to was found to be 9"l“5 - 2“8-4"7“6-3» 

J ' 

Assuming that this sequence was derived in the usual manner, by assigning 
numbers to the letters of a keyword in accordance with their relative 
positions in the normal alphabet, then it is likely that the digit 1 in 
the foregoing numerical key represents a letter at or at least close to 
the beginning of the alphabet. Since the digits 2 and 3 ere to the 
right of , 1 in the key, it Is likely (1) that the letter represented by 
1 occurs two more times in the keyword, or (2) that they represent an- 
other letter, also near the beginning of the alphabet, and repeated, or 
(3) that they represent two different letters both near the beginning 
of the alphabet. The digit 4 must represent a letter beyond the letter 
represented by the digit 3; the digit 5 must represent one beyond the 
letter represented by the digit 4, cud so on. Assuming that the letters 
composing the keyword are fairly woll distributed over the entire 
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alphabet the digit 7 must represent a letter near or slightly beyond 
the middle of the alphabet, the digit 3 must represent one further 
toward the end of the alphabet than does the digit 7> and so on. As- 
signing several values to the digits, in accordance with the foregoing 
principle, the results are as follows: 

1-2- 3-/.- 5- 6- 7-8-9 

9-I-5-2-8-4-7-6-3 

RAKAMFLKA 

SBLBMGMLB 

TCMCOHNMC 

UDNDPIOND 

VEOERJPOE 

W 

X 

Y 

Z 

FIGURE 7. 

d. Now comes tho trying process of finding a "good" word in this 
' assemblage of letters. The beginning and end of the word are the 

easiest points of attack, and it is useful to keep in mind the relative 
frequency order of letters as initial and final letters of the language 
in question. 

For English, the data are as follows: 9 

As Initial Letters TSAFCORD.NFEMIWBHLUGYVJQKZX 

As Final Letters ETDSNYROHLAFGPMXCKWUBIZQJV 

Studying the list; of letters at the end of the key, it is seon that E 
is one of the possibilities. If that is correct, then a good ending 
would be one of tho typo Y-C-V, with E as the final letter. There is 

9 

Taken from Tables 2-D (2) and 2-E (2), p. Ill, Military Cryptanalysis, 
Part I. 
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but one vowel in the column under the digit 7» the letter 0. This 

gives OKI, OLE, OME, ONE as possible ending trigraphs, the best of 

which from a frequency standpoint is ONE. Seeing the letters P and 

G in columns 5 and 6, the ending PHONE and then the word TELEPHONE 

suggests itself. Checking to see if there are any inconsistencies, 

none is found and the solution is: 

Column number ..... l-2=3-4-5-6-7~8-9 

Numerical key 9 - l~5"2-8-4"7 , "^”3 

Literal key TELEPHONE 

e. In future studies cases will be encountered wherein the re- 
construction of the numerical key is an essential or at least useful 
element after the solution of one or more cryptograms has been 
achieved by cryptanalysis; this is done in order that subsequent crypto- 
grams in the same key can be read directly without cryptanalysis. The 
reconstruction of the numerical key is, however, a different process 
than the one illustrated in this paragraph, wherein the problem is 
solely one of building up a literal key from its numerical equivalent. 

11. Column and row transposition. - It should be obvious that 
when the rows as well as the columns of a completely-filled rectangle 
undergo transposition the increase in security is hardly worth mention, 
since the underlying procedure in solution aims simply at assembling a 
few columns on the basis of "good" digraphs and trigraphs brought to 
light by juxtaposing columns . After three or four columns have been 
properly Juxtaposed, the placement of additional columns becomes easier 
and easier, merely by continuing to build upon the fragments of words 
in the rows . Hence, the cryptanalyst is, during a large part of the 
process, not particularly interested in the intelligibility of the text 
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he is building up; only at the end of the procoss does this become a 

factor. ¥Jhen all of the columns have been assembled in proper order, 

« 

then the text will read continuously in the normal manner (left to 
right, top to bottom}. If it does not, then it is usually a very 
simple matter to rearrange the rows of the rectangle to bring this 
about, since the letters at the ends and beginnings of the rows give 
the necessary clues for continuity. 
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SECTION III. 

INCOMPLETELY-FILLED RECTANGLES 

Paragraph 



General principles underlying solution 12 

Construction of diagram 13 

Solution of example 14 

Alternative method of solution 15 

Example of solution by alternative method 16 



12. General principles underlying solution. - &. In the system 
designated keyed colu mnar transposition the feature which differen- 
tiates an incompletely-filled rectangle from one that is completely 
filled is a very simple one from the cryptographic point of view: the 
bottom row of the rectangle in the former case merely lacks one or more 
letters, a feature which only very slightly complicates the system in 
practical operation. But the consequences of this simple difference 
between the two types are, from the cryptanalytic point of view, quite 
profound, and the cryptanalytic effect of this small chango in crypto- 
graphic procedure Is seemingly all out of proportion with the simpli- 
city of the difference. 

b.. Cryptograms involving completely-filled rectangles are 
rather easy to solve because of two circumstances. In the first place, 
since the rectangle is completely fillod, the various possible dimen- 
sions of the rectangle can bo ascertained by noting the factors of the 
total nvmber of letters. Usually only a few possibilities are indicated 
and therefore this materially reduces the amount of experimentation 
that would be required in the absence of this situation, since it is 
obvious that when working with incompletely-filled rectangles a good 
many rectangles of various dimensions become possibilities for trial. 
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In the second place, the columns in a completely-filled rectangle 
all contain the same number cf letters, and therefore the anagramming 
process (matching and assembling of columns) can be performed without 
any mental reservations such as must be made in working with incompletely- 
filled rectangles because of uncertainty as to whether the letters which 
are juxtaposed to form digraphs and trigraphs really came from the same 
row m the plain-text rectangle. The latter statement calls for a bit 
more explanation. 

i 

c. The columns of an incompletely-filled rectangle are of two 
sorts which may conveniently bo designated as long and short . The long 
columns are at the loft of the rectangle and each ono contains just one 
more letter than the short columns, which are at tho right. This 
follows, of course, from the fact that it is only the last row in such 
a rectangle which lacks one or more lettors to complete the rectangle. 

The term width, as applied to a transposition rectangle, v/ill be con- 
venient to designate the number of columns, which is, of course, 
determined by tho length of tho numerical key or the number of letters 
in the literal key. Given the width of the rectangle and tho total 
number of letters in the cryptogram, tho length and number of tho long 
and the short columns may bo found by a simple calculation: Multiply 
the width of tho rectangle by the smallest number which will yield a 
product greater than the total number of lettors in the cryptogram. The 
multiplier gives tho length of tho long columns; this multiplier minus 
1 gives the length of the short columns; ths excess over the total 
number of letters gives tho number of short columns, the latter 
deducted from the width gives the number of long columns. Thus, with a 
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cryptogram of 287 letters and a rectangle 15 columns In -width: 

|(l5 x 20) - 13 s 287] ; the long columns will have 20 letters, the 
short ones, 19 letters; there , will be 13 short columns and 2 long ones. 

d. Now if the cryptanalyst were able to cut up the text of a 
cryptogram produced from an incompletely-filled rectangle into sec- 
tions corresponding in length vd.th the actual long and short columns, 
he could handle these columns in exactly the same manner that he 
handles the equal-length columns in the solution of a cryptogram pro- 
duced from a completely-filled rectangle. In fact, the solution would 

be easier because he knows that all the short columns fall at the right, 

) 

all the long columns at the left of the transposition rectangle, and 

“"I 

therefore the amount of experimentation he must undertake in his 

1 

attempts to juxtapose columns in the anegramming process is considerably 
reduced. But, unfortunatoly, there is usually no way in which, at the 
initial stage of solution, tho cryptanalyst can find out, from a 
single cryptogram, which are the long columns and which the. short. This 
is obviously a matter directly connocted with tho specific transposition 
key, and the latter is the solo unknown factor in the whole problem. 

e, If it were practicable to transcribe a cryptogram of thi3 
type according to all the possible transposition keys for a given width 
of- rectangle, solution would obviously merely consist in scanning the 
various rectangles to find the one which is correct - for there will be 
only one such rectangle. A rectangle 15 columns in width may have been 

1 

enciphered by any one of factorial 15 transposition keys. 1 While it is 

^Factorial 15, or 15 x 14 x 13 x x 1, equals 1, 369, 944» 576,000 
different transposition keys. 
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conceivable that machinery might be devised for this purpose, so that 
the production of the millions of possible rectangles could be effected 
in a relatively short time, in the present state of the art no such 
machinery has yet been devised. Furthermore , it is problematical 
whether a solution by such means could be achieved in a reasonable 
length of time even if the machinery were available, because of the 
immensity of the task it would have to perform. 

f . However, this question may be asked: Given a cryptogram of 
T letters and a rectangle of n columns in width, is it possible to tran- 
scribe the text within a single rectangle so that the latter will show 
what letters will constitute the respective columns for all possible 
transposition keys of n elements? If so, then such a rectangle would 
be useful in trying to solve the cryptogram, because the rectangle 
would then limit the amount of experimentation that would have to be 
performed by the anagramming process, since it would show whether or 
not two letters which are brought together in that process to foim a 
digraph could possibly have been in the same row in the plain-text 
rectangle. If not, then of course there would be no use in forming 
such digraphs, and thus the number of trials becomes much reduced. An- 
other way of indicating what is meant is to say that such a rectangle 
would show the maximum amount that one column may be shifted up or down 
in trying to match it with another column in the anagramming process. 
This will be made clearer in a subsequent paragraph. At this point it 
will merely be stated that it is easy to prepare a rectangle of the 
nature indicated above, for any keyed columnar transposition cryptogram. 

13. Construction of diagram. - a. Given the following cryptogram 
of 224 letters and an assumed width of 12 columns in the enciphering 
rectangle: 
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0 D N N P 
D S T E 0 
M S C L G 
F M B I E 
T N D A H 
E A 0 0 T 
A E N E E 
ALODI 



TIRNT 
I T D M A 
S 0 E F C 
H B V T B 
I R HQ I 
H E A C N 
1ITTJI 
RORYN 



CRYPTOGRAM 



D T U R 0 
N L N 0 E 
F F T E E 
E S R S Y 
E T E T N 
S H E E V 
T A N L N 
NRGY 



i 

E X A L N 
B 0 U H E 
E M I A I 
L X R 0 R 
0 T R A A 
T R E S R 
N U A C L 



L E T G N 
N L E S E 
T E A I J 
DMETY 
V R I R S 
A I I E A 
R E N-R T 



W T T M E 
A A C T R 
N S 0 I V 
0 I K N,K 
T G S E F 
T E E A L 
R A T S 0 



Distribution 



J ' 

* $ 

/_ „ . 

§ ://// = //-=////- -£i/E E _ 

ABCDEFGHIJKLMNO P_Q RSTTJVV/XYZ 

r 

\ 

b. A cryptogram of 224 letters and a rectangle of 12 columns 
Q 12 x 19 ) - 4 s 224 ] indicates 4 short columns of 18 letters and 8 long 
columns of 19 letters. The outlines of a rectangle of this specification 
are drawn on a sheet of cross-section paper and the text is transcribed 

* 

within it, for the moment assuning merely that the transposition key 

consists merely of the straight sequence of numbers 1 to 12. Thus: * 



J 

/ 



/ 



l 

' I 
*11 
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c. The rectangle shown in 
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Fig. 8 is the same as though it had 
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been assumed that the key numbers 9» 
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10, 11, and 12 happened to fall at 
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the extreme right in the numerical 
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transposition key. Columns 1 to 8, 
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inclusive, would then be long columns, 
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and columns 9, 10, 11, and 12 would 
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be short columns. But suppose that 


A 


T 


A 


E 


I 


E 


T 


E 


R 


T 


R Y 




L 


D 


A 


E 


E 


T 


E 


A 








the key numbers on the extreme right 
























happened to be 1, 2, 3, and 4, instead 








FIGURE 8. 
































of 9, 10, 11, and 12. Then columns 1, 


2 


t 

1 . 


3, 


and 4 would 


be the short 


columns, 5 to 12 the long ones. In this 



case, making reference to Fig. 8, the final letter of column 1 would 
pass to the top of column 2; the final two letters of column 2 would 

pass to the top of column 3; the final 3 letters of column 3 would 

pass to the top of column 4; the final 4 letters of columns 4, 5» 6» 7» 

and 8 would pass to the top of columns 5* 6, 7> 3, and 9; the final 3 

letters of column 9 would pas3 to the top of column 10; the fin a l 2 
letters of column 10 would pass to the top of column 11; and the final 
letter of column 11 would pass to the top of column 12. The results of 
the foregoing reasoning are indicated in Fig. 9« 

d. Now the capital letters in Fig. 9 represent the letters which 
are in the columns in caso the first hypothesis (key numbers 9» 10 , 11, 
'12 at the extreme right) is true. The capital letters above the heavy 

i 
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123456789 30 3112 
t m u i e 
e e b m e f e 
taeietesy 
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FIGURE 9. 
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Mack line together with the small letters at the top of she diagram 
(the latter forming what may he termed the crown) represent the letters 
which are in the columns in case the second hypothesis (key numbers 1, 

2, 3, 4 at the extreme right) is true. Therefore, Fig. 9» since it 
covers the two possible extremes with reference to the positions 
occupied by the short columns, embraces all possible intemediate con- 
ditions and shows what letters may be in the respective columns under 
any possible arrangement of long and short columns , and hence this 
diagram is applicable to any possible numerical key for the cryptogram 
in question and for the assumed width of rectangle . Therefore, in the 
anagramming process such a diagram shows the maximum possible amount 
that any column may be shifted up or down in juxtaposing two colutans to 
form digraphs of letters assumed to come from the same row in the plain- 
text rectangle. This is because all the letters of the 1st row of the 
actual enciphering rectangle will be found in rows 1 to 5» inclusive, 
of Fig. 9; all the letters of the 2d row of the rectangle will be found 
in rows 2 to 6, inclusive, and so on, as indicated by the braces at the 
right in Fig. 9- 

e. Thus there arises the following Important principle: Desig- 

nating the number of short columns in a specific diagram by .n, only such 
letters as fall within (n -f- 1) consecutive rows, will be letters that 
may have appeared in the same row in the actual transposition rectangle. 
Or, another way of stating the principle is this: both members of any 
pair of letters actually m the same row in the transposition rectangle 
will be found only among the letters appearing in (n -j~ U consecutive 

i 

rows in tho reconstruction diagram. In the case under discussion, if 
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the first letter of such a pair, is located in row 8, for example, the 
other letter cannot be in rows 1, 2, 3, or 13 to 23 of Fig. 9* 

f. The usefulness of this principle will soon bedame apparent. 

For example, again referring to Fig. 9, take the letter Q, in row 19, 
column 7; it must be followed by a U in the plain text. There are 4^'s 
in the message; they are in row 13 column 11, row 14 column 3, row 17 
column 1, and row 20 column 6. Now the question is, can any of these 4 
U f s follow the Q, or may one or more of, them be eliminated from con* 
sideration at once? Since the U*s in rows 13 and 14 fall outside the 4 
consecutive rows above that in which the Q, is located, it follows that 
neither one of these U*s can be the one that succeeds the Q. Thus two 
candidates are automatically eliminated from consideration. The U in 
row 17 and the U in row- 20 are both possible candidates. 

i 

14. Solution of example. * a. With the foregoing preliminaries 
out of the way, the solution of the cryptogram can now be carried for- 
ward with rapid progress. It has been indicated that the Q, in row 19, 
column 7, (rig* 9) , may be combined with either the U in row 17 column 
1, or the TJ in row 20 column 6. Suppose the columns of Fig. 9 are now 
cut apart for ease in anagramming. Juxtaposing the indicated columns 
yields what is shown in Fig. 10. Since the combination shown at 
Fig. 10a involves column 1, it obviously begins with the letter 0 and 
ends with the letter A or L; no other letters can be added to this 
column. Since column ? is already the maximum length this column can 
bo under any circumstances, no letters can be added to it at the bottom. 
Therefore, all the digraphs possible to foxm by juxtaposing these two 
columns are indicated in Fig. 10a. There are only 17 digraphs in all. 
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£1 • 


2 ± 




u 


u b 


whereas there should be at least 18. 


m 


m i 




e 


e e 


Hence, combination 7~i is impossible, and 


t 


t H 




Y 


Y B 


combination 7“6 is the only one that needs 


0 


0 V 




I 0 


I T 


to be considered further. There are many 


K D 


K B 




N N 


N E 


excellent digraphs m it, and only one 


K N 


K S 




T P 


T R 


which admittedly looks rather bad, the HX. 


N T 


N S 


1 


D I 


D Y 


Seeing the digraphs KB and KS in these 


A R 


A L 




H N 


H X 


columns, a good assumption to make is that 


I T 


I R 




R D 


R 0 


the K»s are preceded by the letter C. Is 


H T 


H R 




QU 


QU 


there a column with 2 C's in approximately 


I R 


T M 


E 0 


E E 


the correct region? Column 4 meets this 


T E 


T T 




E X 

A 


E 


requirement. Note the excellent trigraphs 


A 


L 




it yields, as shown in Fig. 10c.. It now 


a 


b 


becomes fairly easy to add columns to this 


FIGURE 


10. 

f 


nucleus. For instance, the trigraph R Y B 



suggests a word ending in R Y, such as INFANTRY, ARTILLERY, CAVALRY; 
the trigraph MOV suggests MOVING; the trigraph C K B suggests the 
word ATTACK; followed by a word beginning with B, and so on. Trial of 
only a few columns soon yields what is shown in Fig. 10[d, from which it 
soon becomes probable that the long columns end with column 12, since 
the letters after L Y yield an impossible sequence [EIEY). Since it 
• was originally assumed that thore are only 4 short columns in the trans- 

position rectangle, and since 4 columns have already been placed at the 
right (4"7”6-10) , the rectangle, witfi the columns thus far placed, must 
be as shown in Fig. lOe. This then at once tells what the limits of 
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t-7-6 


HL&-4-7-6-D 
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a u b 


columns 2, 3» 5» 8, 9, and 11 must be. 


aub 


a m 1 e 




ami 


o r c e e s 


and the rectangle can now be filled 


c e e 


D A T t H r 




T t H 


N T K Y B A 


in' without further delay. The com- 
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N S li 0 V I 
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pleted rectangle is shown in Fig. 11. 
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FIGURE 10c 


FIGURE lOd 
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Jb. The last step, recovering the literal key, is then taken. The 

key is to be found among the letters of the diagram in Pig. 12. 

6-2-5- 3-U.-9-1-32-4-7-6-XI 
NEMERN ARHNMP 
OFNPSOBSIONR 
PGOGTPCTJFOfe 
RHPH HD KRP-T 

FIGURE 12 

The teimination ATIONS seems a likely possibility. If this is correct, 

assignment of letters becomes modified as shown in Pig. 13: 

8-2-5- 311-9-1-12-4-7-6-D 
OENETPATIONS 
P R 

R S 

FIGURE 13. 

The word PENETRATIONS will fit and it is taken to be presumably correct. 

There is no absolute certainty about the matter, for it is conceivable 

* 

and possible that there are other words which can be made to fit the 
sequence of key nunbers given, but inasmuch as the recovery of the 

1 

literal key is not an essential part of the solution and is often 
merely a subject for curiosity or speculation, no further time will be 

t 

spent on the matter. 

15- Alternative method of solution. - a. The foregoing solution 
will no doubt appeal to the student as being straightforward and simple - 
if the original assumption as to the width of the transposition 
rectangle is correct . But, unfortunately, there is no way of knowing 
whether such an original assumption is correct until solution is well 
under way. In practice, of course, what might be done within a well- 
organized crypt analytic unit would bo to divide up the work among the 
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individuals constituting the unit, each being assigned one or more 
specific hypotheses to try out with respect to width of rectangle. 

Then one of these individuals would find the correct width and he 
would be joined by the others as soon as an entering wedge had been 
found in this way. Or, if the cryptanalyst is working alone, he must 
txy out successive hypotheses as to width of rectangle until he hits 
upon the correct one. In making these hypotheses he must be guLded by 
previous experience with enemy correspondence, which may afford clues 
as to minimum and maximum widths "of rectanglos. 

b. However, thor a is another method of attack which does not 
necessitate making any definite initial asstmptions with respect to 
the width of the transposition rcctanglo. This method is a modifica- 
tion of the method sot forth in the preceding paragraph. The text of 
the cryptogram is written out columnwise on cross-section paper, every 

i / * 

5th letter being numbered for purposes of reference. Plenty of space 
is left between the columns, and about 10 or 15 letters at the bottom 
of each column are repeated at the top of the next column so that at'' 

r 

any point in the transcription there will bo m a single unbroken 
string at least one complete column of letters from the transposition 
rectangle. Then a section of consocutivo letters of text is written on 
a separate strip of cross-section paper, columnwise of course, and by 
juxtaposing this strip against the whole text, sliding it to various 

i 1 

points of coincidence against the text, an attempt is made to find that 

position in which the best digraphs are formed of the letters on the 

' » 

movable 3trtp and the fixed sequence. Of course, if there is a Q in 
the cryptogram, the sliding strip section is made to contain this letter, 
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and the strip is then placed against the text where a U is found, so 
as to form the digraph QU. The digraphs formed above and below tho QU 
are then studied; possibly a written record is made of the digraphs 
found. Then the same thing is done with the Q and all other U»s in tho 
text, to insure that a correct start is made. It is this initial step 
which i3 likely to give the most difficulty (if there is anything 
difficult at all In the procedure) and it is important that it be cor- 
rect. If this first step is easy, then solution follows quite rapidly; 
if the cryptanalyst is unlucky and makes several false starts, The 
process is likely to be a slow one. In choosing from among several 
possible juxtapositions it may bo advisable to calculate the probability 
value of each possibility by adding the frequoncy values of tho di- 
graphs, as explained in Par. ?d. In tho absence of any Q’s m the 
text, recourse must be had to tho formation of other probable digraphs, 
based upon the presence of certain other tell-tale low-frequency 
letters, such as C, H, J, K, V, anl X. The cryptanalyst is fortunate 
if there are two or three of these low-frequency letters close to one 
another in a series of letters, for m this case he can search for a 
place where there are high-frequency lotners (in a corresponding 
sequence) that might be combined with than. For example, suppose that 
a toxt shows a sequence ... V E H K K ...; a sequence such as ... 

A R T C C ... would be excellent to try, for it vail yield the digraphs 
AV, RE, TH, CH, CK. Or if there is a long sequence of consonants, the 
cryptanalyst should look for a correspondingly long sequence of vowels, 
since these make tho best combinations and are therefore most probable. 
For these reasons it pays to study the text quite carefully before 
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choosing a starting point, to find all such peculiar sequences as 
might be useful in affording a good point of departure. It should 
also be noted that there are at least two correct positions at which 
the sliding strip can be juxtaposed against the text, since in the 
enciphering rectangle the letters in one column form digraphs with the 
letters in the column not only on the right but, also on the left. In- 
the absence of any'Q’s, or other lowrfrequency -letters suitable for a 
point of departure, the very first 20 or 25 letters of the cryptogram 
may be used as the starting point, since these letters come from column 
1 of the transposition rectangle and therefore there is no uncertainty 
at least as to the letter which is at the top of that column; or,, the 
last 20 or 25 letters of the cryptogram* may be used as the starting 
point, since these letters come from the last-numbered .column of the . 
rectangle and therefore there is no, uncertainty at least as to the 
letter which is at the bottom 'of that column. 

_c. Suppose that a good initial juxtaposition has been found for 
the portion of tho text that has been written on the sliding strip, and 
that a series of excellent digraphs has been brought to light. The ... 
next step is, of course, to add to these digraphs on either side by 
finding sections of text that will yield "good” trigraph3 and totra- 
graphs. For example, suppose that the initial juxtaposition has 
yielded what is shown in Fig. 14. The digraph PR suggests that it must 
be followed by a vowel, preferably S, A, or 0; tho digraph AV might be 
part of the word CAVALRy, in which case it will be followed by A; the 
digraph GR suggests that it might be followed by the vowel A or E. A 
place is therefore sought, in the rest of the text, where there is a 

r~ 
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sequence of the letters here desired, and, of course, at the proper 



intervals. Suppose such a sequence is found and yields what is shown 



in Fig. 15. 


The skeletons 


of words are now beginning to appear. 


• • 


• • • 


Assuming that A V A is indeed part 


• • 


■ • • 


of the word CAVALRY, there should be 


R R 


R R S 




N A 


NAT 


an L to follow it; the trigraph TIN 


P R 


P R E 


T 0 


TOR 


suggests the termination G; the tri- 


A V 


A V A 




R E 


RED 


graph Z E R suggests the word ZERO. A 


T H 


T H R 




C H 


CHU 


section of text is therefore sought. 


C K 


' C K A 


I L 


ILL 


which will have the letters L, G, 


T I 


TIN 




C R 


C R A 


and 0 in the order 


B E 


B E S 




Z E 


Z E R 


L i£.24tJLi> G i..£. 0 * Enou#i has 


E A 


E A 0 


• • 


• • • 


boon shown to demonstrate the procedure 


• ■ 


• • • 

• • • 


In the course of the work it soon be- 


FIGURE 14. 


FIGURE 15. 


comes evident where the ends of 



columns are, because the digraphs 

above and below the nuclear or "good" portion become "bad" quite sud- 
denly, just as soon as letters belonging to non-adjacent columns in 
the original rectangle are brought together. For example, in Fig. 

15 it is observed that the topmost trigraph R R S is highly improbable, 
and likewise the bottom-most trigraph E A 0. This suggests that these 
letters have been brought togother erroneously, that is, that they do 
not belong in adjacent columns in the enciphering rectangle. If this 
is true then the "good" portion is composed of the 13 letters between 
these two extremities and therefore the columns are about 13 letters 
long. Additional work will soon show exactly how long each column really 
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is, and when this has been ascertained the problem has been practically 
completed, since at the same time that this becomes evident the 
sequence of columns has also become evident* 

16. Example of solution by alternative method. - a. Using the 
cryptogram of Far. 14 as an example, Fig. 16 shows how the text might 
be transcribed on a sheet of cross-section paper. Noting that the 
message contains a Q as the 129th letter, a section of text to include 
the Q is transcribed on a strip of cross-section paper and this strip 
is then juxtaposed against the whole text so as to bring the Q. in front 
of a U. How many lottors should be included in this strip? The 
message contains 224 letters; if a width of say 10 .to 20 columns is 
assumed, the columns of the rectangle will be about 12 to 22 letters 
in length. It will be safer to assume a convenient length closer to 
the maximum than to the -minimum; consequently a length of 20 letters 
will be tentatively assumed. Now the Q, may be at the top of a column, 
at the middle, or at the bottom — there is no way of telling at this 
point. Hence, to make sure that nothing is overlooked, suppose a sec- 
tion of 41 letters is taken, with the Q at the center. There are 4 
U's in the message, and four trials are to be made. The results are 
as indicated in Fig. 17. Examining combination 1 in Fig. 17, the 
digraphs formed both above and below the QU aro not at all bad. In 
fact, not one of those above the QJJ is impossible and the same is true 
of those below the QU until the digraph V N is reached. Hence, combina- 
tion 1 is possible. As for combination 2, this at once appears to -be 
bad. Trigraphs such as 1 I, and I H are highly improbable, and this 
combination msy be discarded with safety. Combination 3 is possible from 
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40 A 
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S 

55 E 
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T 

60 R 
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65 C 
S 
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70 c 



61 M 
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L 

65 C 
s 
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E 
F 

70 C 
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E 

75 E 
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K 
I 
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80 I 
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I 
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I 
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100 B 
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T 
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E 
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C 
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Y 
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F 

190 I 
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FIGURE 16. 
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1 


2 


3 


1 

4 . 




0 


OT-28 


OF-91 


OE-177 


the bop digraph, 0 F, to 


R 


EM 


RM 


RE 




U 


UE-30 


UB 


UA 


the 12th digraph below the 


M 


MD 


MI 


Ml =180 




E 


ES 


EE-95 


EA 


Q, U, although the digraph 


T 


TT 


TH 


TE 




Y 


YE 


YB 


YN 


H X -looks very bad. Hov\r- 


0 


00-35 


OV 


OE 




10 


11 


IT 


IE-185 


ever, the X might be a 


KD 


KT 


KB-100 


KM 




NN 


ND 


HE 


W 


sentence separator, so that 


KN 


KM 


ES 


KT 




TP- 5 


TA-40 


TR 


TF 


this combination cannot be 


NT 


NN 


NS 


NI-190 




DI 


DL 


DT-105 


DT 


discarded. Combination 4 


AR 


AN 


AL 


AA 




HN 


HO 


EX ’ 


HN 


looks very improbable, with 


IT-10 


IE-45 


IR 


IXr 


1 


RD 


RB 


RO 


RN-195 


the digraph E N occurring 


HT 


HO 


HR- 110 


HN 




QU 


QU 


QU 


QU 


twice, and other equally 


IR 


IH 


IM 


IA 




E0-15 


EE- 50 


ES 


EG 


bad digraphs showing. Of the 


TE 


TIT 


TT 


TL-200 




EX 


EL 


EY-115 


ER 


four possibilities then, com- 


TA 


TE 


TO 


TE 




NL 


NS 


HI 


NN 


binabions 2 and 4 are dis- 


0N-20 


OE-55 


OE 


OR 




TI 


TA 


TN 


TT-205 


carded, leaving 1 and 3 fo r 


RE 


RA 


ItK-120 


RR 




AT 


AC 


AT 


AA 


further study. It is very 


AG 


AT 


AN 


AT 




TO-25 


VR-60 


VD 


VS 


difficult to choose between 


RVJ 


HM 


RA 


R0-210 




IT 


IS 


IE-125 


IA 


these two possibilities. All 


RT 


RC 


HI 


RL 




SM 


SL 


SR 


SO 


the digraphs in combination 


TE-30 


TC-65 


TH 


TD 




GD 


GS 


GQ 


GI-215 


1 down to digraph V N are 


SS 


SO 


SI-130 


SR 




ET 


EE 


LT 


EO 


possible; many of them are 


1 


2 


3 


4 




V D are 


FIGURE 17. 

al30 possible and many 


of them 


excellent. As for combination 
3, ail the digraphs down to 
are oxoellent. Thoro does not 


seep to 


be much 


use to add the frequency values of the digraphs in each 
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combination because it is hard to know with what digraphs to begin or 
end. However, perhaps it is not e 33 entlal that a choice be made at 

I 

once; possibly further work along the lines now to be demonstrated will 
show which combination is correct . Noting the two K»s (in the di- 
graphs K B and K S) among the combinations before the Q, assume that 
these K»s are parts of the digraph GK. Is there a sequence C-C in the 
text? There is but one such place, at the 63 rd letter. Suppose the 



corresponding section is placed in front of the combinations 1 and 3 of 



Fig. 


17 , as 


shown in Fig. 18. 


It immediately becomes evident that 




SOF 


SOFV 


combination 3 is the correct one, for 




ERM 


ERMT 






ADB 


AUER 


note the excellent trigraphs it gives, 




AMI 


AMIE 






mgE 


CEES 


as compared with those in combination 1 . 




TTH 


TEHR 






RIB 


RIBA 


Also note that the second trigraph below 




MOV 


MOVI 


SIO 


SIT 


SITE 


the E ft U in combination 3 consists of 


GKD 


CKB 


CKBE 




INN 


LNE 


LNEA 


three E*s, indicating that the end of 


CKN 


CSS 


GKST 


STP 


STR 


STRE 


the columns has been reached just before 


ONT 


ONS 


ONSE 




EDI 


EE5T 


EEflA 


this trigraph. As for the top trigraphs 


FAR 


FAL 


FALL 




CHN r~ 


CHX 


CHXA 


of Fig. 18, they are good all the way up. 


FIT 


FIR 


FIRE 




PHD 


FRO 


FRON 


But now the skeletons of words are be- 


THT 


THR 


THRE 




EQJJ 


EQU 


EQUE 


ginning to appear. The T H R immediately 


ELR 


EDI 


TCTMM 




EEO 


'hct. 


EREV 


above the EQU suggests either THREE 


MTE 


MTT 




IEX 


IET 


FIGURE 19. 


or THROUGH; tho FRO above the T H R 


ATA 


ATO 






INL 


INI 




suggests FROM or FRONT. Suppose the 


TON 


TOK 






ETI 


ETN 




word REQUEST is assumed for the E Q U, 


ARE 


ARK 






IAT 


IAT 




and the word THREE is assumed for the 


JAG 


JAN 






1 


3 




T H R above it. This requires a sec- 


FIGURE 18. 




tion with two E*s in succession. 
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There are several such places in the text, and further limitation is 
advisable. The 8th trigraph from the top is certainly suggestive of 
the word MOVING, which requires an I to follow the V. Is there a 
place in the text where an I occurs 12 letters before a double E? 

There is one such place, and the corresponding section is juxtaposed at 
the proper place, yielding what is shown in Fig. 19- The upper and 
lower limits of the columns are now fairly definite and are marked by 
the horizontal bars; tetragraphs E E E Y at the bottom and A M I S at the 
top are very improbable. The tetragraph C E E S below the top bar is 
possible, because it msy represent the end of a word Dike FORCE followed 
by the beginning of the word ESTIMATED; the tetragraph below the bottom 
bar suggests a word ending in E followed by the word IMMEDIATE. It 
seems hardly necessary to continue with the demonstration; in a few 
moments the entire diagram is reconstructed and yields the solution. 
During this process, as soon as a section of text in Fig. 16 has been 
used it is crossed off, so as to prevent its lettors from being con- 
sidered as further possibilities for addition to the reconstruction 
diagram. Thus, as the work progresses the number of availablo sections 
becomes progressively less, and the choice for successive sections for 
addition to the diagram becomes a quite easy matter. 

b. When two or three operators are assigned to work upon a 
cryptogram by this method, solution can be reached in a very abort space 
of time, especially if each one of^tho operators takes a different point 
of attack. After a few minutes the fragtionts of texts obtained may 
be assimilated into one message which is then completed very speedily. 



- 48 - 



REF ID : A56913 



SECTION 17. 

OPPORTUNITIES AFFORDED BY STUDYING ERRORS AND BLUNDERS MADE BY ENEMY 
CRYPTOGRAPHERS. 

Paragraph 



Importance of the study of errors and blunders in early work 

upon an unknown system 17 

Significance of terms special solution and general solution . . IS 
Examples to be studied 19 



17. Importance of the study of errors and blunders m early 
work upon an unknown system. - ja. Blunders and mistakes made by 
cryptographic clerks in the execution of cryptographic instructions 
should be rare in a well-trained and well-disciplined cryptographic 
service. Nevertheless, blunders and mistakes sire committed despite all 
that can be done bo prevent their occurrence. Especially in the excite- 
ment prior to or during an important action or movement do such 
instances take place and these afford golden opportunities for the 
enemy cryptanalytic service. This eituaticn exists in respect to 
all types of cryptographic systems and no cryptanalytic instruction 
would be complete if cognizance were not taken of the advantages which 
may bo reaped from the blunders, the mistakes, and, occasionally, the 
downright ineptitude of the adversary 1 s cryptographers. 

jb. Practically evory cryptographic system affords opportunities 
for the commission of errors in its application, and each system more 
or less presents a separate case. That is, the errors which may be 
made in one type of cryptographic system may be peculiar to -chat type 
alone and to no other type; hence, the astute cryptanalyst is constant- 
ly on the lookout for inctances of cryptograms containing the specific 
type of error by which that system is handicapped. Furthermore, the 
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general types of blunders or errors that may be committed are nearly 
as numerous as are the general types of cryptographic systems, so 
that no complete list of such as may be encountered in practice can be 
drawn up. 

_c_. After the cryptanalyst has by painstaking and more or less 

• i • 

arduous labors solved a system and has become thoroughly familiar with 
its mechanics, he should carefully .review the details of the mechanics 
to learn what things can go wrong, what sorts of mistakes the enemy, 
cryptographic personnel are likely Jo make, and then study the external 
manifestations of these aberrations so that he may be able to recognize 
instances of their occurrence in subsequent cryptograms. This sort of 
study has no value in itself particularly; its importance lies in the 
fact that the effects of erroneous treatment may lead to very rapid 
solution or to quick recovery of keys of subsequent messages. 

d. When an unknown system is under investigation and the crypt- 
analyst is striving to ascertain just how it operates (which is of,ten 
the most difficult step in solution) , a study of the cryptograms rep- 
resenting ^corrections to previous messages containing errors is a most 
fruitful source of data. Indeed, at times this sort of intensive 

r 

study will yield clues for solving a system which might otherwise 
resist all efforts to break it down for a very long time. 

18. Significance of tezmS' special solution and general solution. - 
a. Now the importance of the comments made in the foregoing paragraph 
will be clear if it is .noted that a study of the blunders and errors 
often leads to the elaboration of methods for- the rapid,, breaking down 
of cryptographic systems. Btit it must also be realized that in some 

j 



- 50 - 



j 



REF ID : A56913 



cases no blunders or errors are essential to a rapid solution of the 
type alluded to above: sometimes the mechanics of the system are such 
that unavoidable or unpredictable circumstances arise, so that 
special solutions become possible. The latter term calls for a bit of 
explanation. 

t 

b. When the circumstances surrounding a specific cryptogram or 

’ set of cryptograms are such as to present peculiar or unusual conditions 
that make a solution possible when in the absence of these conditions 
solution is either impossible or improbable, the methods employed in 
reaching a solution in such cases constitute what is commonly termed a 
special solution . Some examples will be demonstrated very soon. 

i 

Systems of which this may be true are, of course, cryptographically 
weak but it may be observed that it is perhaps impossible to devise a 
system which may bo considered to be absolutely free from this source 
of weakness. 

c. The advantages of a special solution for any type of, crypto- 
graphic system arc, as a rule, two in number. First, it often makes a 
solution possible when otherwise this might not be the case. Secondly, 
it often affords a method of achieving a very rapid solution in the 
case of a problem which otherwise might require a long time. But a 
special solution presents one basic disadvantage: it is by its very 
nature dependent upon the existence of unusual circumstances, in other 
words, upon chance or good fortune bringing about, a set of circumstances 
favorable for a solution. When these unusual conditions or circumstances 

i 

do not obtain, then solution may be Impossible. Therefore, it is 
desirable to have, if possible, for every type of system a more or less 
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general solution which may be applied in the absence of the unusual 
conditions necessary for the application of a special solution. In 
other words, a general solution in cryptanalysis implies a method or 
procedure which if applied in ordinary cases and under normal conditions 
will yield the solution. However, the term general solution in crypt- 
analysis must not be taken too literally. The situation m crypt- 
analysis is not exactly analogous to that which obtains in the field of 
pure mathematics, for the circumstances are often quite different in 
the two sciences. A general solution in mathematics is expected to 
and will solve every case that falls within its province; a general 
solution in cryptanalysis is intended to solve every case that falls 
within its province but this 13 more of a hopo than an expectation. 

Much depends upon the amount of traffic available for study, the length 
of individual cryptograms, and the indefinable oleraent called "luck", 
that is, a set of fortuitous circumstances which happen to make a 
solution easy or difficult, such as the presence of many or excep- 
tionally long repetitions, etc. Furthermore, whereas in mathematics a 
general solution prescribes the exact steps to be fo 3 lowed in arriving 
at the solution; the latter can bo applied in all instances without 
variation or deviation "from a fixed procedure, in cryptanalysis a 
general solution merely outlines a broad path that may be followed in 
order to arrive at a solution; application of the latter m specific 
instances may involve minor detours to circumvent unexpected obstacles, 
or it may involve quite large changes or modifications in the general 
procedure. 
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19. Examples to be studied. - a. As stated above m Paragraph 
17 » a complete list of the specific blunders that cryptographic clerks 
are prone to perpetrate cannot be drawn up. Certain of them may be 
described in general terms and examples given of some which have al- 
ready been encountered in this and m preceding texts. Commonly it is 
the case that those blunders do not become evident until two or more 
cryptograms are available for comparison. One of the most frequent 
sources of circumstances leading to the transmission of cryptograms 
affording rich material for cryptanalytic comparison is the following: 

A cryptographic clerk prepares a cryptogram, in the course of which he 
makes a mistake of such a nature as to render the cryptogram difficult 
or impossible to decipher by the cryptographic clerk serving the ad- 
dressee. A request for repetition onsues, wheroupon the enciphering 
clerk reexamines his original work and finds that jie has made a mis- 
take. He then commits the grave blunder of reenciphering the identical 
message (without paraphrasing) and transmitting what to tho enemy 
cryptanalysts is obviously a second version of the original message. 

The consequences are often fatal to cryptographic security. The least 
that can happen is that the key for this particular message may be 
disclosed very quickly; more serious, the basic or primary elements for 
the entire day’s traffic may bo wrested from the blunder; but most 
serious are the consequences if it happens that the blunder has been 
committed immediately or soon after a new cryptographic system has been 
instituted and the enemy cryptanalysts are exerting strenuous efforts to 
learn its mechanics, for then is when the information to bo gained is 
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b. In the next few paragraphs same specific examples of the 
consequences of cryptographic blunders and ineptitude in the case of 
transposition systems will be studied. These are intended to give the 
student some idea of the far-reaching effects such studies may have. It 
is important that he grasp the fundamental principles for they will 
enable him to develop for himself the methods that he may find necessary 4 

in practical work. Incidentally, it may be added that the student 
should not get the idea that these instances are purely theoretical. 

It is sometimes almost unbelievable that cryptographic clerks with any 
common sense would perpetrate the stupid blunders that they do occasion- 
ally commit. 

t 

l 
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SECTION V 

' SPECIAL SOLUTIONS FOR TRANSPOSITION CIPHERS 

Paragraph 



Solution when the beginning or end of the plain text is known .... 20 

The case of an omitted column 21 

The case of an interchanged pair of columns 22 

Messages with similar beginnings 23 

Messages with similar endings 24 

The solution of a single message containing a long repetition .... 25 

Solution when several cryptograms of identical length and in 

the same key are available 26 

Recovery of the transposition key 27 

Special cases of solution of double transposition ciphers 28 

Concluding remarks on transposition methods 29 



20. Solution when the beginning or end of the plain text is 
known. - a. It often happens, when correspondents have fallen into 
the bad habit of sending stereotyped comrauni cations, that the begin- 
nings or the ends of messages become so fixed in their form and content 
that the enemy can with a fair degree of certainty guess what these will 
be in specific cases. If so, a quick solution can be reached and the 
key reconstructed for one message, and this will of course enable him 
to read all other messages in the same key. This is particularly true 
of simple keyed columnar transposition ciphers. It is only necessary 
that- the cryptanalyst cut the text up in such a manner as to bring 
the letters composing the assumed text all within the same row or rows 
of the transposition rectangle. 

b. Suppose that, the.] .enemy is addicted to the introductory ex- 
pression REFERRING TO YOUR NUMBER. ' Here is a cryptogram assumed to 

j 

•b •* 

begin with this phrase: 
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CRYPTOGRAM 



IUAOD 


R H G R N 


E R N I N 


TUSFS 


D R Y E P 


B R C F T 


0 I R N W 


T M U I S 


0 I E G E 


DHOPN 


CHLFU 


E S E P Q, 


E R I A R 


UHIAG 


P A U 0 0 


S S S C I 


ONRRE 


0 V 0 E Y 


E M E V G 


T R I A F 


H T E P B 


N B T N E 


A E E T A 





Cm Assuming that previous experience has indicated that the enemy 

» 

uses keys varying £rom 10 to 20 letters in length, the arrangement of 
the letters in the tops of columns under a key length, of 10 would be 
as shown in Fig. 20. 

123456789 3fr 
REFERRINGT 
0Y0URNUMBE 
E 

FIGURE 20. 

The 1st group of the cryptogram begins with I M. The arrangement shown 

above gives I U as the top of a column: hence a key length of 10 is not 

correct. A key length of 11 is "than tried. 

123456 789 3031 

REFERRINGT0 

Y0UR.NTTMBER 

FIGURE 21. 

Here a column is headed by I M, so that this is a possible arrangement. 
If the width of the rectangle is 11, its outlines are as shown in Fig. 
22. There are 5 columns of 11 letters and 6 columns of 10 letters. The 




FIGURE 22. 
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text can now be marked off into sections of proper lengths and, more- 
over guided by the letters which must be at the heads of columns, 
the text can be inscribed in the rectangle in key order. For example, 
column 1 must end with the 2d group, R M GEN; column 2 therefore 
begins with E R. There is only one possibility, viz, the 4th column. 
This is a long column, and must therefore have 11 letters, making 
column 3 begin with R Y. This definitely fixes the position of the 
number 3 in the key, and so on. The solution is reached after only a 



3962471H5D8 
REFERRING TO 
Y0URNUM3ERS 
EVENWHATDIS 
POSITIONHAS 
BEENMADEOFC 
RYPTOGRAPHI 
CEQUIPMENTO 
FMESSAGECEN 
TERFOURTHPR 
OVISIONALBR 
I G A D E 

FIGURE 23. 



very few moments and is as shown in Fig. 23* 

d. The same general principles, 
modified to suit tho circumstances, 
may be followed in the case Involving 
known or suspected endings of messages. 
The probable words are written out 
according to various assumed key lengths 
and the superimposed letters falling 
at the bottoms of columns are sought 

in the cryptogram. 

21. The case of an omitted column. - a. Sometimes a very care- 
less clerk omits a column in transcribing the text from the enciphering 
rectangle and fails to chock the number of letters in the final crypto- 
gram. Obviously such a cryptogram will be difficult if not impossible 
to decipher at the other ond, and a repetition is requested and sent. 

If now the identical plain text is enciphered correctly, two crypto- 
grams are at hand for comparison. This will disclose the length of 
one column, which can be assumed to be either a long one or a short one. 
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The position, in the correct cryptogram, of the column omitted from 
the incorrect one will often afford direct clues as to the exact 
dimensions of the enciphering rectangle. For example, suppose the 
cryptogram in Par. 20_b had first been transmitted as follows: 

CRYPTOGRAM 

I M A 0 D RMGRN RYEPB RCFTO I ROT MOISO 

IEGED HOPNC HLFUE SEPQE RIARU HIAGP 

AUOOS SSCIO NRREO. VOE'YE MEVGT R I A F H 

TEPBN BTREA EETA 

b. The column which was omitted isERNINTUSFSD, and 
falls between columns 1 and 3- Since the omitted column contains 11 
letters and column 1 contains 10, the dimensions of the rectangle 
immediately become known. Thus, uncertainties as to the dimensions of 
the rectangle are dissolved and a large step in the solution taken. 

Also, the general positions of columns 1 and 2 are now known, since the 
former is a short one, the latter a long one. 

22. The case of an interchanged pair of columns. - a. The keying 
element in the case of columnar transposition is simply a practical 
means of controlling the order in which the columns of the enciphering 
rectangle are transcribed in forming the cipher text. Commonly this 
numerical key is derived £rom a literal key. Suppose that a crypto- 
graphic clerk makes a mistake in the latter step. For example, suppose 
that the literal key is ALMIRATION and that as a result of a slight 
relaxation in attention he assigns the number 5 to the letter N and 
the number 6 to the letter M. A pair of columns will became interchanged 
as regards their order of selection xn the transcription process, and 
likely as not a repetition will be requested by the addressee. If a 
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second version is sent, enciphered by the correct hoy, a comparison of 
the two versions will disclose the width of the enciphering rectangle 
and possibly the general position (left or right) of the columns that 
were interchanged. 

b. An example will serve to make the matter clear. Assume the two 
cryptograms to be as follows: 



FIRST VERSION 



0 D N I L 

1 N E N E 
0 0 C 0 0 



N T T H D 
NFUEfl 
R 0 G I 0 



G S 0 H A 
R W R R I 
S 



0 0 Q 3 G 
R A T P E 



T E R P S 
D E T A N 



SECOND VERSION 



0 D N I L 
TJ E H R W 
0 0 C 0 0 



it i t a d 

R P S I N 

R 0 G I 0 



G S 0 H A 
E N E R I 
S 



0 0 Q S G 
R A T P E 



T E R N F 
D E T A N 



c. The two cryptograms are superimposed as shown in Fig. 24 and 
their points of similarity and difference noted. 

1st version .. ODNILNTTHDGSOHAOOQSGTE R JP S I N E N 5) 

2nd version . . ODNILNTTHDGSOEAOOQSGTE R© F U E H R W, 

1st. version ..(|fU E H H W§E I S AT P E D 1 T AS 0 0 COOROGI 0 

2nd version .. |P S I N E N |R I R AT P E D E T AN 0 0 C 0 0 S 0 G I 0 

FIGURE 24. 



d. The two versions are alike except for a pair of interchanged 
sequences; the bracketed sequence P S I N E N E in the 1st version is 
matched by the same sequence in the 2d version, but at a different 
position in the message; likewise the bracketed sequence N F U E H R W R 
in the 1st voreion is matched by a similar sequence in the 2d version, 

i 

but at a different position in the message. The various deductions 
which can be made from tho situation will now bo 3et forth. 
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e. One of these sequences contains 7 letters, the other contains 

\ 

8. It follows that the columns of the enciphering rectangle are 
probably- 7 end 8 letters m length; hence, with 61 letters, the width 
of rectangle is 8. Since there are 23 letters from the beginning of 
the messages to the first point' of their difference, it follows that 
there are 2 columns of 8 letters and 1 column of 7 letters involved 
in this section [1(2 x 8) -|- (1 207) - 2jj,and that tho error made in 
encipherment docs not involve columns 1, 2, or 3i which are therefore 

1 

properly placed in the 1st version. Since the sequences which are 

interchanged aro consecutive in the text it means that the numbers 4 

and 5 were interchanged in the key for the 1st version. Since one of 

these sequences is of 7 letters, the other of 8 letters, one of the 

numbers, 4 or 5, applies to a long column, the other, to a short column. 

Since the 2d version is presumably the correct version, and since in 

the 2d -version the 3-letter sequence comes first,, the key number 4 

* 

applies to a long column, tho key number 5, to a short column in the 
correct version. With the foregoing deductions in mind, the solution 
and the reconstruction of the numerical key becomes a simple matter. 

f. The text of the correct version is written out. as soon in 

Fig. 2511. Seeing a Q in column 3 and aU in column 4» these two columns 
are made adjacent by sliding column 3 one interval downward, as shown 
in Fig. 25b. In the latter, column 7 has also been placod to the right 
of column 5> because it yields good trigraphs with columns 3~4* Seeing 
the bri graph THO near tho bottom of columns 3-4“ 5 and the letters 
0 and P in the same row, suggests the word TROOP. The columns are to 
be rearranged to make this word TROOP. Thore aro two columns which have 
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c 0 N E T R ONETROOP 

d o OFTHI OFTHIRPS 
OTANERPO QUADS QUADEONI 

DHOFTISR SENGA SENGAGIN 

NDQUAEI 0 GHOST GHOSTILE 

IGSENANG TROOP TROOPONN 

LSGHOT1I EWCHE EWCHESTE 

NOTEOPSO RRO D RROAD 

THEWCE1S 
T R R 0 D 

a. b_ £ a 

FIGURE 25, 

an 0 in the proper row, columns 2 ana 8. The trial of combination 
3 - 4 “ 5 " 8 “ 6, ^iie producing TROOP in the proper row, gives baa penta- 
graphs in the other rQws; but the combination 3”4“5“2-6 shows excellent 
pantographs, as will be seen in Fig. 25c. The words SQUADRON and 
HOSTILE are clearly evident; the completion of the rectangle is now a 
very simple matter. The result is shown in Fig. 25^1. The recovery of 
the numerical key now will enable other cryptograms to be read directly. 

23. Messages with similar beginnings. - a. In military corre- 
spondence it is often the case that samowhat similar instructions or 
information must be conveyed by a superior commander to several sub- 
ordinate commanders simultaneously. Such a situation frequently re- 
sults in the circumstance that two or moro cryptograms addressed to 
different stations will begin with exactly the same words. When simple 
columnar transposition is the system used for encipherment , then it 
will result, in such cases as the foregoing, that the first two or more 
rows of the transposition rectangle will be identical in the messages 
which begin alike. Therefore, the cryptograms will show identical 
sequences of two or more letters, distributed throughout the texts and 



a c 

to do 

OHONPREO 
DDQFSITR 
NGSUIRAO 
ISGENANG 
LOTHETOI 
NHERNPOO 
TARWEECS 
TO R DO 
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by studying these identities the crypt anelyst is able at once not only 
to ascertain the width of the rectangle but also to divide up the cipher 
text into sections corresponding. with the exact columns of the rectangle, 
thus eliminating the only real difficulty in solution, viz, the deter- 
mination of which are the long columns, which the short. . An example 
will demonstrate the short cut to solution which such a situation 
provides. 



b. Here are two cryptograms which are assumed to have been inter- 



cepted within a few minutes of each other, the messages being addressed 
to two battalion commanders by the regimental commander. 

CRYPTOGRAM 1 



BNTSE 
0 T 0 K M 
0 F 5T r 
A R P A T 



ABKCL 
SZTQH 
0 T 0 T D 
0 U T I 0 



CETTE 
YI1DK 
N I N 0 E 
B I E 0 A 



BITER 
LANAS 
W X E R F 
G A A j? N 



ROTAE 
FTESH 
A S I 0 S 
E I K 



L T N N 0 
P G IT P A 
T I D R R 



ENENO 
R W 0 1 A 
HUM A 0 



CRYPTOGRAM 2 



BNTSE 
IITJTO 
W 0 A R 0 
OCMMA 



INDOT 

KMEEY 

EEKTF 

OOSCA 



L C E T S 
KPCYI 
C T T L T 
N R 0 U T 



APPLE 
T D V S I 
A E A N 0 
I E E ji S 



R R 0 H 0 
N T A E F 
E W X P V 
0 A G A A 



I S 0 E N 
T F S T 0 
T I T I 0 
ABITH 



HONST 
K TEAR 
S T T T F 
T 



e_. The cryptanalyst now carefully compares the two texts, looking 

for identical sequences of letters between the cryptograms. For example, 

> 

No. 1 begins with BNTSE and so does No. 2; after an interval of 4 



letters in No. 1 and 5 letters in No. 2 he notes the identical sequences 



L C E T; aftor an interval of 5 letters in No. 1 and 5 letters in No. 2 



he notes the identical sequences E R R 0, and so on. The identities 
are underlined or marked in some distinctive mannor throughout tho 
texts, as shown in Fig. 26. - 
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CRYPTOGRAM 1 



£b N T S U 


ARK c| 


cet|tn b I t§r 


R 5|t A E 


L t[n N 0 


n}n E N 0 


o|okm) 


SZTGS 


(yi t|k lan^e 


F T F |n 


PGNP (I 


R W 3 I A 


0 F GjT F 


c t]o. t d 


N i(n 0 E W x)e R F 


a s(i 0 s 


t}i d r r 


rJm m a 0 1 


A R P AT 


(o U T fjo 


B I E o[a G a A p}n 


E I K 










CRYPTOGRAM 2 








[b n t s eJ 


IHDOT 


Jl gitJs a f ? l[e 


RR§110 


iso e(n 


n o nJs t 


i i u(t 0 


K mJf e y 


kpc|yi T^VSI 


nt[aef 


T F 3}T 0 


N T N|A R 


w o)a r 0 


E E EjT F 


C t)t l T A e a(n 0 


E ft xJp V 


T I T(l 0 


s t]t t f 


o c{m m a 


ojo s c a 


N r[o u t Qe e l s 


oJa g a aJ 


A B I T R 


T 



FIGURE 26. 



d. Now it is obvious that these identities exist because the two 
messages begin alike, and by taking advantage of the identical portions 
in the cryptograms It. will be possible to transcribe the texts of the 
latter into transposition rectangles wnich shall not only have the 
identical portions in homologous positions, but also shall show which 
are long columns, which are short. All that as necessary is to begin 
transcribing the texts on cross-section paper, in columns, arranging 
matters so that the identical sequences will fall at the tops of the 
columns. Thus, the 1st column of No. 1 will contain the letters 
B N T S E ARK C and the 1st column of No. 2 will contain the letters 

B N T S E I N D 0 T; the 2d column of No. 1 will contain 1;he lotters 

L C E T T N B I T and the 2d column of No. 2 will contain the letters 

L C E I S A F P L, and so on. It appears that the identical portion 

embraces the first four rows of the roctangle and runs over a number of\ 
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letters on the 5th row. This Is because the Identical sequences con- 
sist of 4 and 5 letters. Fig. 27^.ehows the identities between the 1st 
5 columns of the two transposition rectangles. Only once in the case 



1 


2 


of this particular example does any 




BLENT 


BLENT 




* 


N C R N 0 
T E R 0 K 


N C R N 0 
T E R 0 K 


uncertainty arise as to exactly where 




STONli 


S T 0 N M 


an identical sequence begins or ends, 




ETTN8 


E S M S F 






A N A E Z 


I A 0 -T E 


and that is in connection with the 7th 




R B E N T 


N F I I Y 






K I L 0 G 
C T T 0 N 


DPSIK 
0 L 0 U P 
T E -C 


pair of identities, involving the 
series of letters AEFTFSNPGNP 





FIGURE 27a. in No. 1, and A E F T F S TONTNin 



No. 2. These sequences contain 6 identical letters, but oven here the 
uncertainty is of only a moment's duration: the initial letter A does 
not belong to the identical portions at the top of the transposition 
rectangle because the A's are needed to complete columns 6 in both 
rectangles. (If the A Were placed at the head of column 7 in No. 1, 
then column- 6 would lack a letter at the bottom.) Cases of "accidental 
identities" of courso complicate the process of cutting up the text 

j 

into the respective columns, but they only servo to add a small degree 
of interest to* what would otherwise be a purely cut and dried process. 
The final results of the transcription into columns are shown in Fig. 
2?b. 



u e. It is clear from a comparison of these two transposition 
rectangles, and a consideration of the fact that the long columns must 
of necessity go to the left side, that the numbers 7 and 10 occupy the 
first two posit ions in the key, and that the numbers 2, 4, 11, and 13 
occupy the last four positions in the key. -By segregating and a n a gr am m ing 
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1 

123456789 30 31 3213 14 
BLENTYEATNIMOA 
NCRNOIFRFOOMUG 
TEROKTTWCESATA 
STONMDFOTWTOIA 
ET TNSKS I 0 X I A 0 P 
ANAEZLNATEDRBN 
RBENTAPODRRPIE 
KILOGNGFNFRAEI 
CTTONANGIARTOK 
P S 



2 

123456789 301132 3314 

BLENTYEATNIMOA 

NCRNO JFRFOOMUG 

TEROKTTWCESATA 

STONMDFOTWTOIA 

ESMSFVSATXTOEA 

IAOTESTRLPTSEB 

NFIIYIOOTVFCLI 

DPSIKNNEATOAST 

OLOUPTTEEICNOR 

T E CANKAT R T 



FIGURE 27b. 



1 . 



7-10 23.1-13-4 

E N LION 

F 0 C 0 U N 

TE ESTO 

FW TTIN 

S X T I 0 N 

N E N D B E 

PR BRIN 

G F I R E 0 

N A T R 0 0 

P S 



2 . 

73.0 . : 211-13-4 

LION 
U N 
T 0 
I N 
E S 
E T 
L I 
S I 

0 u 



E N 

F 0 CO 

TE ES 

F W T T 

S X ST 

TP AT 

0 t; F T 

NT FO 

T I L C 

N T 



FIGURE 27_c. 



columns 7 and 10 as one group, and columns 2, 4, 11, and 13 as another 

1 

group, the exact positions occupied by these 6 columns are easily as- 



certained, as shown in Fig. 27£. 

f. The remaining columns 1, 3i 5 » 6, 8, 9» 10, 12, and 14 foim a 
third group of columns to be anagrammed, but this is rather easy now 
that the columns on either side are fixed. The completed rectangles ’ 



are shown in Fig. 27d. 

24. Messages with similar endings. - a. What has oeen said at 
the beginning at the preceding paragraph with respect to the nature of 



military correspondence and the presence of identical phraseology in 
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KNEMYBATTALION ENEMYBATTALION 

FORMINGFORCOUN FORMIKGFOROOUN 

T E8 ATT A‘C K W E S T 0 TERATTACKWESTO 

FWOODS'ATMOTTIN FliQODSATUOTTIN 

SXTAKEPOSITION SXMOVEATFASTES 

N E AH L AM T Z AND B E TPOSSIBLERATET 

PREPAREDTOBRIN OVICINITYOIFLI 

GFLANKINGFIREO NTSANDTAKEPOSI 

NATTACKINGTROO TIONTOREPELCOU 

PS NTERATTACK 

FIGURE 2?d. 

the messages sent by a superior commander to his subordinates also 
operates to produce messages in which the endings are identical. It 
has been noted that when two messages with similar beginnings are 
available for comparison, the reconstruction of the transposition 
rectangles and the recovery of the transposition key is an easy matter. 

It will now be shown that solution is an even easier matter when two 
messages having identical endings are available for study, 
b. Given the following two cryptograms: 

No. 1. 

ETRTE EESOA AEUNI VAFLN IAMND RYHRV MENRI 

EETRO UDCCC OHTCY MRREA RHITN DEYEN RNERV 

SHEEN 1GSKA ILNRA NFNAD ALOLT X 0 M A II ERREI 



No. 2. 

TLYSX OPNRS K E F D S KYENR UEERB TSREII TIAHT 
IVYMR VESIR EENEI N-OLTM NNEDE TROOP CNAHA 
CIAAI NSCWN A 

The cryptanalyst now carefully compares the two texts, searching for * - 

identical sequences of letters, but in this case instead of trying to 

a 

locate identities in what may bo termed a parallel progression (as in the 
preceding caso) he searches for identical sequences of two or more letters 
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* 




appearing in both messages. For example, in the present case, he 
notes the sequence T R 0 forming the final trigraph of the 8th group of 
No. 1 and finds a similar sequence forming the initial trigraph of 

the 13th group of No. 2. Going through both cryptograms in this way, 

% 

all the identities are marked off in some fashion, by colored crayon or 
by brackets, as shown below. In this search for identities the crypt- 

1 

analyst bears in mind that when all have been found they should be 
distributed at quite regular intervals throughout the text. For example, 
noto in the following that the identities in No. 1 fall at intervals 
of 6 letters, with one exception; in No. 2 they fall at intervals of 4 
letters, with one exception. The intervals between identitios serve as 
a guide in finding them. After thoy have all been located, the 
identities in the cryptograms are numbered serially. 

No. 1 



E T R T E 
E E[T R ^ 

sJr 9 |1e N 



• .1 2 

E sjo A A E U Njl vJa F L N 

UDCCG ojHTjCY MRRE[a 

10 21 
i g s k[a iJinra NF(na|d 



I a[m nJ D R Y H R V (m eJn R I 
_ 8 

R}H I T N DEjYENJRNERV 

12 13 

ALOLT [X§MAH H R r[e ij 



No. 2 



TLVS|X < 3 pnrs &e]fDS K (? E n]r UE eIf^b] TSREj^fJlANT 
[i vJy m r v | 7 s] I R E E N N 0 L T[k 9 NjlEDE & * 030 p uh^eJa 



22 



13 



C I a£a f) NSCwf a] 



- 6 ? - 



REF ID : A56913 



£. The numbers above the identities may now be used to draw up a 

i 

table of equivalencies of identities. For instance , identity 1 m 
cryptogram 1 matches identity 7 in cryptogram 2; identity 2 in crypto- 
gram 1 matches identity 6 in cryptogram 2, and so on. Thus: 

Cryptogram 1 ... I-2-3-4— 5-6— 7-S-9-10-11-12-13 
Cryptogram 2 ... 7-6-9-2-IO-5-II-3-4-I2-I3 — 1 — 8 

d. Now cryptogram 1 has 105 letters-, since the key consists of 
13 numbers (indicated by the 13 identities), the rectangle for crypto- 
gram 1 contains 12 columns of 8 letters and 1 column of 9 letters. 
Cryptogram 2 has 81 letters, and its rectangle contains 10 columns of 6 
letters and 3 columns of 7 letters. The rectangle of cryptogram 1 has 
but 1 long column, whereas that of cryptogram 2 has 3 long columns. 
Relative to the position the last letter in each rectangle occupies in 
the last row of tlio rectangle, it is obvious that the last, letter of the 
rectangle for cryptogram 2 is 2 let tors m advance of the last letter of 

the rectangle for cryptogram 1. Using thi3 difference, viz , 2, a 
• * 

cyclic sequence is generated from the series of equivalencies given 
above. Thus, the equivalent of .identity 1 of cryptogram 1 is identity 
7 of cryptogram 2, and the' number 7 is placed two intervals to the 

t 

right of the number 1; tho equivalent of identity 7 of cryptograin 1 is 
identity 11 of cryptogram 2, and the number 11 is placed tiro intervals 
to the right of number 7, and so on until the following sequence is 
obtained: 

1-2-3-4-5-6-7-8-9-10-11-12-13 
r 1- 7- 11- 13- 8- 3- 9 

0. The equivalent of identity 9 of cryptogram 1 is identity 4 of 
cryptogram 2, and tho number 4 is placed betwoen The numbers 1 and 7 in. 
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tills sequence, for the sequence may he regarded as partaking of the 

nature of a cycle or a continuous series. From this point on, the 

process is the same as before, and finally the following is obtained: 

1— 2— 3— 4— 5— 6— 7— S'— 9— 10— 11— 12--13 
I—4—7—2—II—6—I3—5—8—IO 3- -12 9 

f. After little oxporiment it bocomes obvious that column 8 

belongs on the extreme loft and that the key is 

8-10-3-12-9-1-4-7-2-11-6-13-5. The completely deciphered messages are 
shown in Fig. 28. 



8-10-3-12-9-1- 


i 

“ 4 " 


- 7 - 2 - 31 - 6 - 13-5 


8-30-3-32-9- 1-4- 7- 2-11- 6-i> 5 


H 


E 


A 


D 


R 


E 


D 


C 


0 


L 


U 


M 


N 


I 


N 


F 


A 


N 


T 


R 


Y 


P 


0 


I 


N 


T 


I 


N 


F 


A 


IT 


T 


R 


Y 


A 


W 


D 


A 


R 


R 


E 


D 


C 


0 


L 


U 


M 


IT 


P 


A 


S 


S 


T 


I 


L 


L 


E 


R 


Y 


M 


A 


R 


G 


H 


I 


E 


D 


S 


I 


L 


V 


E 


R 


R 


U 


N 


C 


R 


N 


G 


N 


0 


n 


T 


H 


R 


E 


A 


C 


R 


E 


E 


E 


K 


A 


T 


S 


E 


V 


E 


IT 


T 


w 


E 


D 


S 


I 


L 


TT 

* 


E 


R 


R 


U 


K 


C 


R 


E 


N 


T 


Y 


A 


M 


X 


R 


E 


M 


A 


I 


N 


H 


,E 


K 


A 


T 


s 


E 


V 


E 


N 


F 


0 


R 


T 


E 


R 


E 


I 


N 


0 


B 


S 


E 


R 


V 


A 


T 


Y 


A 


M 


X 


R 


E 


M 


A 


I 


N 


H 


E 


R 


I 


0 


N 






















E 


I 


N 


0 


3 


S 


E 


R 


V 


A 


T 


I 


0 





























N 

FIGURE 28. 

The possibility of the rapid solution of columnar transposition 
ciphers by moans of the method of similar beginnings and endings, 
constitutes one of tho most serious drawbacks to the use of transposition 
ciphers in military cryptography, bocause it is almost impossible to 
avoid such cases where many messages must bo sent in the same key euch 

1 

day. 



25. Solution of a single message containing a long repetition. - 
a. Sometime 3 a lengthy phraso or a series of numbers (spelled out in 
letters) is repeated within a message and if tho message is enciphered 
by a transposition rectangle of such narrow width (m comparison with 
the length of the repetition) that the repeated portion forms identical 
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sequences within the text of the cryptogram, a solution somewhat 
similar in principle to that explained in Far. 24 may be achieved 
within a few minutes. 

b. Note the following cryptogram, in which identical portions 
have been underlined. 

CRYPTOGRAM (169 letters) 



0 E A E L 


T R S E D 


HNUI F 


RHRYF 


N T A E D I 


L S M Y 




la 


lb 




2 a 


N C E T S 


L S T 0 C 


A W I A 0 


T S L S S 


L E D H N 0 


R I I S 


2 b 




3a 


3b 




FEBNN 


U U P W E 


S S M Y E 


R C N N 0 


R V T T A 0 


GNUG GTIFE 




4a 


4b 




5a 


5b 


R S E 0 M 


sv'ern 


R A S T B 


0 S A A A 


0 S N 0 0 I 


B 0 S D 




6 a £b 




7a ' 


C A Y H L 


H 0 N E M 


SETFY 


H L A IPX 


TAOGG PRSVL 


7b 




8 a 


8 b 




Y E E G G 


T I S S 0 


UDPV 








9a 




9b 









£. There are 18 segments of underlined letters, which means in 
this case that the rectangle is 9 columns wide, because the repeated 

1 

portion in the text will give rise to two repeated sequences in each 
column. This means that the rectangle has 7 columns of 19 lotters and 
2 columns of 18 letters. The first two segments may therefore be as- 
signed the numbers la. and lb., since they came from column 1 ; the next 
two segments may be assigned the numbers 2 a and 2 _b, since they come 
from column 2, and so on, as shown above. A table of equivalencies 
may now be drawn up, showing the segments which are identical. Thus: 

la- 2 a- 3 a- 4 a- 5 a- 6 a- 7 &- 8 a- 9 a 

3 b- 4 b- 2 b- 9 b- 8 b-lb- 6 b- 7 b- 5 b 
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This gives rise to the cycle l-3-2-4-9“5“8-7-6, which is a cyclic 



permutation of the actual transposition key. 

d. By transcribing the text into a rectangle of proper width, 
"cutting" the columns so as to bring the Identical portions within the 



same rows, the result shown in Fig. 29 is obtained. 



123456789 



0 F T R R E 
E N 0 I C R 
A T C I N S 
EAASNE 
L E W F 0 0 
T D I E R M 
R I A B V S 



L 0 



A 0 P 
A N R 
0 E S 

5 M V 
N S L 

6 E Y 
0 T E 



E |S 


T.N 


ft EjB 


Y 


d hi 


slo 


aEmo 


H 


hIy 


L U 


otate 


1* 


UN 


s|p 


|p Ir d a 1 



u 

CSWNACUS 
L E U S A X S 




469153827 
REPORTOFA 
IRRECONNA 
ISSANCETO 
SEVENAMAS 
FOLLOWSEN 
EMYTRIEDO 
BSERVATIO 
NWESTOFLI 
NEGETTYSB 
URGDASHMO 
TJNTHOLLYS 
PRINGSAND 
WASUNSUCC 
ESSFULXEA 
STOFGETTY 
SBURG’ DASH 
1IOUNTHOLL 
YSPRISGSE 
E A V Y F 0 G 



FIGURE 29. 



FIGURE 30. 



e. Study of Fig. 29 
shows that columns 2 and 7 
are the short columns and 
belong on the right, either 
in the sequence 2-7 or 7”2. 
The cyclic permutation of 
the transposition key ob- 
tained in subparagraph £ is 
1-3-2-4-9-5-8-7-6 
In order to bring the 2 and 
7 adjacent in a sequence 
2-7 or 7*2 one must take 



intervals of 3 and 4, respectively, and "decimate" the cycle, giving the 



following: 

1-5- 3-8- 2- 7- 4- 6-9 or 1-9-6-4-7-2-8-3-5 
Since columns 2 and 7 belong on the right, the key must be: 
4-6-9-1-5-3-8-2-? or 8-3-5-1-9-6-4-7-2 
Only a few moments are necessary to establish the correctness of the 
former alternative and the solution is at hand. It is as shown in 



Fig. 30. 

26. Solution when several cryptograms of identical length and in 



the same key are available. - a. Although the method to be described in 



- 71 - 



REF ID : A56913 



this paragraph is included within the category of special solutions, it 
is of such general applicability that it might well be treated as a 

.lw 

general solution for all transposition systems. It is based upon the 
very mechanics of transposition as a cryptographic scheme, viz, that 
the essential feature of the transposition method consists merely in 
the alterations in the positions of the elements (letters, groups of 
lettors^ or words) composing the plain text according to a specific key. 

It follows, therefore, that the respective elements of two or more 
messages of identical lengths, when transposed according to the same key, 
will undergo identical alterations in position in the course of encipher- 
ment, and therefore all plain-text elements occupying homologous posi- 
tions in the original messages will' emerge in homologous positions in 
the cryptograms. The situation is very much like that which may be 
observed in the movements executod by two symmetrical groups of dancers 
in a chorus. Suppose each group consists of 8 dancers starting originally 
,in definite positions relative to one another. When a movement is 
executed each dancer. in each group performs certain evolutions; at the 
conclusion of the movement the 8 dancers m each group may be in quite^ 
different positions relative to one another than they wore at the be- 
ginning of the movamont, but the correspondingly numbered dancers m 
both groups find themselves in identical positions relative to their 
neighbors. Of courso, the fact that in this analogy the groups are 
based upon 8»s is of no significance; if the groups consistod of many 
more the principle would still apply. Another way of looking at the 
matter is to call attention to the fact that in any type of transposition 
the position which a specified letter or element of the plain text will 
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occupy In the final cryptogram is quite definitely a function of the 
number of letters or element a in the plain text itself . For example, 

' r 

suppose that a plain-text message contains exactly 100 letters, and 
suppose that the transposition systam and specific key is such that the 
1st pldtin-text letter appears as the 17th cipher-text letter, the 2d 
plain-text latter, as the 68th, and so on; in another message of 
exactly 100 letters, enciphered by the same general system and specific 
key, it is obvious that tho 1st plain-text lettor must also appear as 
the 17th cipher-text letter, the 2d plain-text letter, as the 68th, 
and so on. In short, all correspondingly numbered plain-toxt letters 
in both messages will appear in identical positions in the cryptograms. 

b. Granting the obvious truth of the foregoing, to what use can 
it be put in the solution of transposition ciphers? Simply this: it, 

l 

enables the cryptanalyst to reconstruct the plain texts of cryptograms ». 
of identical length without oven knowing what the transposition key or 
system was that produced them. The process is not at all complicated 
and if there are several messagos the process is very easy. It con- 
sists in superimposing the several cryptograms and anagramming the 
columns formed by the superimposition, for it is obvious that any cir- 
cumstances which can be used as a guide for rearranging the letters in 
one of the lines of superimposed text in order to form, plain text will 
require and can be checked by the rosults of an identical rearrangement 

j 

of the corresponding letters of the other lines of superimposed text. 

c. An example of tho method involving the application of the 
principles of solution will now be given, using as a basis five messages 
assumed to have been enciphered by an unknown but complex type of 
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i 

transposition. It will now be shown how the security of such a system 
is demolished when it is used by a large number of intercommunicating 
commands. 

d. Let the following be five cryptograms isolated from among 
many messages intercepted on the same day and therefore suspected of 
being in the same key. These five cryptograms have been isolated 

because they all contain exactly the same number of letters. They are 

* 

here shown superimposed (Fig. 31) and therefore all the letters in one 

column have undergone exactly the same evolutions or changes in position 

in tho course of encipherment. 

1 2 3 4 5 6 7 8 9lQ3132PjAK36]7]8BaDa.2Baa.S 
IAALNEOFSGTOGVERANOLNDUOD 
TDNMRGREONARIEUETNYITCGFE 
ANELNEXEHGILACEMEENLFXTEE 
EENETSLNNFTCOIDOSEAILFIGD 
R A M E T M I ONODIUMALL'INXOATGT 






EIHISATFTDNRLVORODSWEERORQ 
AIEUTTARDTEDNSOEIPECMFEARN 
EISIGAORWLLDLVVORDELOCHOTH 
'WIAARNO IHNLLNRFVWLREMRAIEA 
NNAIBTNHITNIASDRMSECUI OVSA 

a. Noting a Q in Message 1 column 51 , the obligatory sequence 
Q U is assumed to be present in that message. There is in Message 1 but 
one TJ, which is fortunate. Combining columns 51 and 23, the results are 
found to be fair. (Fig. 32a) . The H T in the 3d row suggests a j word 
ending in G H T, such as FIGHT, MIGHT, EIGHT, etc. Searching in Message 
3 for a G, two candidates are found: columns 10 and 30* The trigraphs 
yielded by each combination are shown in Fig. 32b. The second of the 
two possibilities looks much the better. Tho trigraph in the first row 
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30-51-23 


QU 


G Q U 


S Q U 


N 0 


N N 0 


T N 0 


E T 


G H T 


GET 


A I 


F A I 


R A I 


A T 


OAT 


BAT 



FIGURE 32a. FIGURE 32b. 



suggests the word SQUARE or SQUADRON; that in the last row suggests 
BATHE or BATTALION. This means that a column with an A at the top and 



a T at the bottom should be sought* There is only one eucli column, 

31. Adding it to the 30-51-23 combination gives what is shown in Fig. 
32c. Looking for a column with a D at the top (for SQUAD) and either an 
A (for BATTALION) or an L (for BATTLE), there is only one candidate, 



column 22, yielding the sequences shown m Fig. 32d_. Enough has been 



shown of the procedure to make further demonstration unnecessary. 



30-51-23-31 
S Q U A 
T N 0 T 
G H T A 
RAIN 
B A T T- 



30-51-23-31-22 Once a good start has been 
SQUAD 

T N 0 T C made, progress is quite rapid, 

G H T A X 

R A I N F unless the cryptanalyst is 

B A T T A 

unfortunate and arrives at a 



FIGURE 32c. FIGURE 32d. 

point where all tho messages 

simultaneously terminate in complete words, without a clue as to what 
follows or precedes in any one of the messages. In such a contingency 
the only thing he can do is to try all sorts of possible continuations, 
either "fore" or "aft", that is, m front of the original starting 
point or after it, until he picks up another word which will enable him 
to continue. Or he may have to search for a new point of entry and 
build upon that, later joining this structure with the other. In the 
case under examination no particular difficulties are experienced and 
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the entire five messages are reconstructed. In the course of this re 1 



construction the numbers applicable to the columns become assembled in 



proper order. This sequence of numbers is shown in Fig. 33» as the 
second row of numbers. In the first row are shown the numbers 1, 2, 



3 , •••! corresponding to the order of the letters in the plain text • 

12 3 ‘ 4 5 6 7 8 5 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 



28 3 ll 46 19 37 25 47 48 26 35 U 2 34 27 12 36 45 17 13 40 18 9 2Q-I 
tr a -a -a a t> rxmowT.g ATIONWAGON S o F 

0 F R 



N 



HAVEORDERED 

ENEMYDEFEATE DDIRECTIO 
SECO'NDECHELO NwiLLLEAVE H ER 
ANIMAL DRAW NV EhICLESOFE n GI 
AMMTJNI TI (3 N T R AlNINCLUDI N G H 



7 



26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 
£ 1 50 44 11 30 51 23 31 22 16 7. 21 32.42 10 49 4 43 15 5 39 29 20 38 6 

FIRSTSQUADHONTO GOLDENVILLE 
ETREATNOTCERTAINAMPURSUING 
EATEI GETAXMXFORGOLDENV ILLE 
NEERTRAINFOLLOWFIELDTRAINS 
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FIGURE 33. 

27. Recovery of the transposition key. - a. Having reconstructed 
the plain text of the messages in the foregoing case, can the trans- 
position key be found? First, it is necessary to ascertain whether a 
single columnar transposition had been used and if not, then the as- 

'1 

sumption will be that a double transposition 3 - had been used. 

b. If a single transposition were the case, then there would be 
a rather simple relationship between the letters which are in adjacent 
columns in the rectangle. Note what happens in a simple transposition 



» 



‘See Special Text No.' 166, Advanced Military Cryptography. Sect. IV. 
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rectangle 3uch as that shown in Fig. 34* where the successive cells are 
numbered and these numbers, taken out of columns just as though letters 
were present in the cells, then are set down as though they constituted 
the cryptogram. The numbers then give the order in which the plain-text 
letters, if present, would appear in the cryptogram. Order in which the 
plain-text letters would appear in cryptogram: 04-12- 20-28*36-44-02- 
10-13-26-34-42-0 6-14- 22-et c . Note the constant difference between 

sequent numbers: 04-12 r 8; 20-12 
s 8; 28 - 20 = 8; etc. The only exceptions 
to this constant difference of 8 occur 
when there is a break occasioned by 
FIGURE 34. passing from the bottom of one column to 



6 2 7 1 5 3 8 4 
01 02 03 04 05 06 07 08 
09 10 11 12 13 14 15 16 
17 18 19 20 21 22 23 24 
25 26 27 28 29 30 31 32 
33 34 35 36 37 33 39 40 
41 42 43 44 



the top of the next one, as, for example, the skip from 44 to 02. This 
constant difference (with occasional exceptions) is an obvious con- 
sequence of the fact that the width of the transposition rectangle is 
8 and simple columnar transposition ha3 boon employed. 

c. In order to ascertain, in the case of the 5 messages, solved 
in Par. 26, whether single columnar transposition was employed, it is 
nocossary first to obtain the series of numbers which give the order in 
which the plain-text letters appear in the cryptogram. This is now easy 
in the case of the 5 messagos solved in Par. 26, for the disarranged 
numerical sequence at the top of Fig. 33 gives the inverse of the sequence 
desired. There the numbers in mixed sequence merely give the order of 
the cipher letters in the cryptogram. Hence, by developing the inverse 
of this sequence, the order in which the plain- text- letters appear in the 
cryptogram may bo obtainod. The disarranged numerical sequence in Fig. 33 
is as follows: 
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FIGURE 35. 

The inverse derived from this sequence is as follows: 



iafl3GaeSiHJE3B0HSKami 



20 1 3 






10 ! 11*12 









FIGURE 36 . 

Such a sequence will hereinafter be termed the basic transpos ition 
sequence , or simply the basic sequence * It merely is a sequence of 
numbers giving the order in whi ch the plain-text letters appear in the 
final .cryptogram. 

d. Since there is seen to, be no constant difference between 
successive numbers in the basic sequence in Fig. 361 single columnar 
transposition is ruled out. Double transposition is now assumed to have 
been used. 

e. Referring back to Fig. 34 , suppose true double transposition 
has been effected. Now note the order in which the plain-text letters 
would appear in the cryptogram. 
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*<1 






6 2 7 1 5 3 8 2, 

01 02 03 04 05 06 07 08 

09 10 11 12 13 14 15 16 

17 18 19 20 21 22 23 24 

25 26 27 28 29 30 31 32 

33 34 35 36 37 38 39 40 

41 42 43 44 

Rectangle D-l 

A 

Basic sequence: 28-42-24-01-19-39" 



6271 5 384 
04 12 20 23 36 44 02 10 
28 26 34 42 06 14 22 30 
33 08 16 24 32 40 05 13 
21 29 37 01 09 17 25 33 
U 03 11 19 27 35 43 07 
15 23 31 39 

Rectangle D -2 
B 

1-26-08- 29-03-23-44-14- 40 - 17 " 35 “ 10 - 



30-I3-33-07-36-06-32-09-27-04-I8-38-21-41-15-20-34-I6-37-H-31-02-22-05- 



25-43 FIGURE 37. 

Nothing in the nature of a series of constant differences between 
successive numbers is now discernible in the basic sequence. But there 
is, as can readily be seen, a fairly constant relationship between 
sections of this sequence. For example , take the series of numbers 
04-18-38-21-41-15 appearing in the latter half of the sequence and set 
them under the series of numbers 12-26-08-29-03-23 appearing in the 
first half of the soquence and find the difference between superimposed 
numbers only when the number in the upper lino is greater than that in 
the lower line. Thus: 



12 - 26 - 08 - 29 - 03-23 

04-18-38-21-41-15 

Differences: 88 8 8 

There is a constant difference between superimposed numbers. The 
reason for the constant difference is not hard to see if one studios 
the rectangle at B in Fig. 37* It is caused by the mechanics of the 
method. The 04 and the 12 come from the same column in A of Fig. 37; 
the 18 and the 26 also come from one column, the 21 and the 29, the 15 
and the 23. But the 08 and the 38 are in different columns in A of 
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Fig. 37* and so are the 03 and -the 41 . These two cases therefore 

1 

represent instances where there is a passage from one column to another 

\ 

in the transposition process. Now the constant difference is in’, this 

case 8 because the superimposed numbers happen to be sequent in the 

* 

1 

columns in which they occur in A, Fig. 37 . If tfao other sections of 

numbers are compared the constant difference may not be 8 but will be 

a multiple of that number. For example: 

28-42-24-01-19-39 
04-18-38-21-41-15 
Differences: 24 24 24 

Here the difference is a multiple of 24 because the superimposed numbers 

1 

are at 3 intervals from each ot&er in the respective columns of Aj Fig. 
37. 

f . The foregoing affords a method of ascertaining the width of 
the transposition rectangle, which is the first step in recovering the 
key. For if a study is made of the numbers appearing in the basic 
sequence shown in Fig. 36 , based upon finding sections which show a 
constant difference, the latter will corrospond to either the width of 
the rectangle or a multiple of the width. An easy way of making this 
study is to take a section of the mixed sequence in Fig. Jb and add 
5 1 8 , 7 , ... to the numbers of the sequence for the totals thus 
obtained from the various additions. A beginning will be made with 
an assumption of a rectangle of 5 columns. Since the cryptograms 
contain only 51 letters, all totals beyond 5i will bo of no significance i 
Hence it is best to take a section which has a long series of low 
numbers so that when the additive is applied the majority of the totals 
will not exceed 51* Such a series is the following (only one number in 
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it is close to the maximum) : 

Section of ) 

basic sequence) . . . 38-35-33-24--7-IO-15-I-48-3I-34-39-25-I4-II-17-- 6 
Totals after) 

adding 5 ) ... 43-40-38-29-12-15-20-6 36- 39-44- 30-19-16-22-11 

Searching through the basic sequence for a section which has a part of 
the sequence of numbers in the totals after the additive of 5 has been 
applied, the results are negative. Trial is then made of additives of 
6 to 11, inclusive, with similar negative results. When an additive of 
12 is applied the results are as follows: 

Section of ) 

basic sequence) ... 38-25-33-24—7-10-15—1-48-31-34-39-25-14-11-17—6 
Totals after) 

adding 12 ) ... 50-47-45“ 36-19-22-27-13 43-46-51-37-26-23-29-18 

It will be seen, on referring to Fig. 36, that the following sections 
are duplicated in the basic sequence: 

50-47; 45-36-19-22; 27-13-2-43-46-51-37-26-23; 29-18 
The width of the transposition rectangle is certainly 12 columns. There 
are therefore 3 long columns of 5 letters and 9 short columns of 4 
letters in the transposition rectangles and Dg. 

gi Having ascertained the width, the next step is to ascertain 
the transposition key. Let the additive 12 be applied to the entire 
basic sequence, as shown in Fig. 38a: 
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A. Basic 


27 13 


sequence 




B. Plus 


39 25 


additive 




A. Basic 


03 45 


sequence 




B. Plus 


15 57 


additive 





02 43 46 51 37 26 
14 55 58 63 49 38 

36 19 22 05 49 38 
48 31 34 1? 61 50 



23 a 30 16 20 

1 

35 53 42 28 32 

35 33 24 07 10 
47 45 36 19 22 



A. Basic 
sequence 

B. Plus 
additive 

A. Basic 
sequence 

B. Plus 
additive 



15 01 48 31 34 39 25 14 11 17 06 50 47 

27 13 60 43 46 51 37 26 23 29 18 62 59 

21 12 40 44 29 18 04 08 09 42 28 32 

33 24 52 56 a 30 16 20 21 54 40 44 

FIGURE 38a. 



A study is now made to isolate and identify duplicate sections in 
lines A and B. For example, in line A the sequence 27-13-02-43-46-51- 



37*26-23 is, except for one number, identical with a sequence in line 
B. The number 02 in line A is replaced by the number 60 in line B. 
Since the number 60 in line B is greater than 51> the total number of 
letters in the cryptogram, it is clear that it represents the 02 in 



line A. Now these duplicate sections consist of 9 numbers, and it is 



clear that two columns of the transposition rectangle are involved, one 

1 

long column of 5 and one short column of 4 numbers. The dividing 

1 

point may be between the numbers 43 and 46, or between 46 and 51. No’ 
decision will be made at the momentas to which of these possibilities 



will be selected. But the whole section will be marked off by brackets 

be 

and the small numbers 1 and 2 vri.il/writtec along the brackets, as 



shown in Fig. 38b: 
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1 2 

A. Basic 127 13 02 43 46 51 37 26 23* U 30 16 20 
sequence 

B. Plus 39 25 14 55 58 63 49 38 35 53 42 28 32 
additive 



A. Basic 
sequence 

B. Plus 
additive 



03 45 36 19 22 05 49 38 35 33 24 0? 10 
15 57 48 31 34 17 61 50 47 45 36 19 22 



A. Basic 15 01 43 31 34 39 25 14 11 17 06 50 47 
sequence 

B. Plus £7 13 60 43 46 51 37 26 23, 29 18 62 59 
additive 

A. Basic 21 12 40 44 29 18 04 08 09 42 28 32 
sequence 

B. Plus 33 24 52 56 41 30 16 20 21 54 40 44 
additive 

FIGURE 38b. 

The next section in line A which has a duplicate in line B is 
41-30-16-20. The two duplicate sections are bracketed and the process 
is continued in this manner and the successive sections are numbered 
successively in both lines until what is shown m Fig. 38£ is obtained: 
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1 2 3 

A. Basic '2? 13 02 43 4# *51 37 26 23^41 30 16 20 * 
sequence 

B. Plus ,39 25 U 55 5^ .63 49 38 35. .53 42 28 32. - 

additive 1 23 



V 



4 5 6 

A. Basic '03 45 36 19 22'D5 49 38 35 M 33 24 07 10* 
sequence 

B. Plus 15 57 48 31 34.17 61 50 47. .15 36 19 2Z. 

additive 4 -5 6 



A. Basic 
sequence 

B. Plus 
additive 



7 8 9 

I 5 01 48 31 34 k 59 25 14 ir'l7 06 50 47 * 

,27 13 60 43 4&.51 37 26 23, 19 18 62 59. 
7 8 9 



10 11 12 

A. Basic '21 12 40 44^9 18 04 OS 1 ^ 42 28 32 1 
sequence 

B. Plus 33 24 52 56,t41 30 16 20. .21 54 40 44. 

additive 10 11 12 



FIGURE 38c_. 



Now a table of equivalencies between the duplicate sections in lines A 



and B -is drawn up, as follows: 

A.... 12 345678 9 10 11 12 
B .... 8 5 12 7 9 41 2 11 6 3 10 

Deriving a chain of equivalents (as in Par. 24 ) , the following is 

obtained: 



1-8-2-5-9-11-3-12-10-6-4-7 

s This is a cyclic permutation of the transposition key. Since Sections 

1 

1* 4» and 7 of line A have 5 numbers, tho other sections only 4, it 
follows that these correspond to long columns, which, of course, go to / 
the left of the rectanglo. Hence the transposition key is 
4-7-1-8-2-5-9-11-3-12-10-6. ' This key may be proved by applying it to 
one of the cryptograms and deciphering it. 
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28. Special case? of solution of double transposition ciphers. - 
a. When the double transposition system is employed in the field and 
is used for a voluminous traffic it is almost inevitable that certain 

situations will arise which make possible a raiher easy solution. Aside 

% 

from the case in which several cryptograms of identical length and in 
the same key are intercepted, other cases of a special nature may ariso. 
Somo of these will be discussed in this paragraph. 

b. First, there is the case in which an inexperienced crypto- 
graphic clerk fails to execute the double transposition properly and 
causes the transmission of a cryptogram which is only a single trans- 
position. The solution of this mossage will be a simple matter and 
will, of course, yield tho key which will permit the reading of all 
other messages even though the latter have been correctly crypto graphed. 
The only difficult part of the matter is to find among a large number 
of intercepted cryptograms one which involves a blundor of this sort. 
When tho cryptanalyst ha3, as a result of considerable experience, 
become adept in the solution of transposition ciphers the work of 
testing cryptograms to ascertain whether or not they involve single 
columnar transposition is not difficult and goes quite rapidly. For 
only a few minutes are sufficient to give him tho "feeling" that the 
cryptogram 13 or is not solvable by single transposition. He might not 
be able to point out any specific indications which give him this 
feeling if asked to do so; nevertheless it must be recognized that his 
intuition is alone sufficient to toll him when there is hope of solution 
along this lino and when further work upon the hypothesis of single 



transposition is useless 
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£, (1) Next ernes the q&se in which the enciphering rectangle of 
a double transposition cryptogram happens to be a perfect square, {that 
is, both D]_ and Dg rectangles are perfect squares) . In this case, not 



only is such a cryptogram detectable at once, since the total number of 
letters is the square of the number of elements in the key, but also the 

j 

cryptogram can be solved in a very simple manner. For the cryptogram 

now represents a case in wh^qh a completely filled rectangle has been 

% 1 

employed, and moreover therq is no need even to assume various widths. 

* i 

(2) Given the following cryptogram of 49 letters (7x?) as 
an example, the text is transcribed as shown in Fig. 39 a and retran- 
scrlbed- as in Fig. 39Jb. 

CRYPTOGRAM 

UCTRN OESHI ETOLR GASOE DUWDD 
NOEOE RDNDI RFENC OEEEM NNVE 



1 2 3 4 5 6 7 
U S R U 0 R E 
C H G W E F E 
TIADSEM 
R E S D D N N 
NIONNCN 
0 0 E 0 D 0 V 
E L D E I E E 



1 2 3 4 5 6 7 

uTteWe 

S H I E T I L 
R G A S 0 E D 
U W D D N 9 E 
0 E R D N p I 
R F E N C § E 
E E M N N ? E 



SL LLULZA 

COUNTER 
HOSTILE 
G E R 0 A D S 
WOUNDED 
E D 0 N R I D 
F 0 R C E E N 
E V E N M E N 



2615374 
HOSTILE 
F 0 R C E E N 
COUNTER 
E D 0 N R I D 
G E R 0 A D S 
E V E N M E N 
WOUNDED 



FIGURE 39a, FIGURE 3f]j. FIGURE 39£. FIGURE 39d. 

( 3 ) The columns of l^g. 39£ are now anagrammod, as in Fig. 

39o, and the rows rearranged, as in Fig. 39d. 

— " f “ 

d T When the enciphering rectangle is not a perfect square but 

t 

nevertheless a complete rectangle, solution of a single cryptogram 
becomes somewhat mo^e diffiqqlt. Here the columns are all equal in 
length | since the last row qf the rectangle is completely filled. Two 
cases will be considered; first, when the width of the rectangle is a 
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multiple of the depth, or number of letters in the columns, and second, 
when the depth is a multiple of the wjdth. 

£.( leaking up the first case, note bhe encipherment in Fig. 40. 
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03 
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1 
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1 


1 



D-2 



Basic 

sequence J 1 * 31 ¥°.W\J7 H "» in? tfjj a 6 j S’ 3 tbit i$ y 3 

Cryptogram IONLE S R 0 $ A NLETV HIWLE GDI I H 



>j 5 ID S’ 7 M 7 813 ii ib n jg tj lizf 30 is i-7 

NF1WL T S E A V R H N 0 E SURDT ALDCG 

FIGURE 40. 

If the numbers above the letters in the cryptogram are examined it will 
be found thai the cipher groups fall into two categories, as follows: 



C 4 9 10 5 7 

14 19 20 15 17 

24 29 30 25 27 

34 39 40 35 37 

44 49 50 45 47 



ii 



/' 2 6 1 8 3 
12 16 11 18 13 
B J 22 26 21 28 23 
36 31 38 33 
46 41 48 43 



(2) There is obviously a definite regularity in the composition of the cipher 
groups udiereby if tho letters m any one group can be assembled properly, 
all the letters in the other groups belonging to the same category 
(A or B) will be assembled correctly too. For example, in category B 
the 3d, 1st, and 5th letters in each group are sequent; in the plain-text 
rectangle in category A the 1st and 4th letters in each group are sequent. 
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Moreover, all the letters in each group came from the same row in the 

D-j. rectangle. Consequently, if two groups coming from the same row can 

he identified, there will he 10 letters which may be rearranged by 

experiment to foim plain text, and the key for this rearrangement will 

apply to all other pairs of groups. For example the message in this 

t \ 

case has a ft and only. one U. -The Q is in the 2d group, the U. is in 

* 1 , "* ■> 

the 9th group. 1 ' These two.. groups come from the same row and -the letters 
may be anagrammed: , ’ *' ' 

i 

, 1.2 3 4 $ and 6 7 & 9 10 

"! S R 0 ft A and S U R D T, 

*"21 6 ’ 8 
8 63fll 4 7 5 9 2 3 
HSTSQTTADRO 

Experiment may now be made with two other groups, applying the same trans- 
position. Thus: 



1 2 3 4 5 and 6 7 8 9 10 
IONLE and NLETV 

2 16 8 - 

0 I N ■ - E 

ENVILLETON 

Obviously the proper key for rearrangement is 8-6-IO-I-4-7-5-9-2-3. By 
continuing this procedure the following additional rows of the D-^ 
rectangle are reconstructed. _ 
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1 2 3 4 5 
iNFIIL 



and 



6 ? 8 9 10 
H I W L E 



8-6-30-1-4 
W H E N W 



7-5-9-2-3 

ILLFI 



1 2 3 4 5 
T S E A V 



and 



6 7 8 9 10 
G D I I H 



8 - 6 - 10 - 1-4 
I G H T A 



7-5~9-2-3 

D7ISE 



1 2 3 4 5 
A L D C G 



and 



6 7 8 9 10 
B H N 0 E 



| 8 - 6 - 10 - 1-4 
NEEAC 



T-5-9-2-3 

E G 0 L D 
% 




The various rows are now assembled in sequence, giving the 'following: 



WHENWILLEI 
RSTSQUADRO 
NR EACH GOLD 
ENVILLETCN 
IGHTADVISE 



The key can now be reconstructed with ease. 



(3) The ciyptanalyst m this case must, of course, make an 



assumption as to the width of the enciphering rectangle before he can 
apply the method. With a number such as 50, the dimensions 10 1 5 or 
5 x 10 suggest themselves. The process of finding cipher groups which 

i 

form pairs on the same row is one of "cut and try." If there is a 
single Q, and a single U in the message, the initial pair of groups is 
obvious. 



f. When the depth of the rectangle is a multiple of the width, 
solution follows the lines of tho preceding case. Taking the same 
message as before, note what happens m encipherment with a rectangle 
of 5 columns containing 10 letters each: 
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L V I E I 
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X* *1931 tl** 
EINDC 



Jt> i»*f»¥ 7 

E A S R V 



FIGURE 41. 



Taking the numbers above the letters and arranging them in sections of 

10, the results are as follows: 

1 2 3 4 5 6 '? 8 9 10 

3 28 1 26 5 30 4 29 2 2? 

8 33 6 31 10 35 9 34 7 32 

13 38 11 36 15 40 14 39 12 37 • 

18 43 16 41 20 45 19 44 17 42 

23 48 21 46 25 50 24 49 22 47 

It is obvious that if the 3d, 9th, 1st, 7th, and £tb columns are made 

sequent, good 'text will be produced within the 3 rows. Thus: 

1-2-3-4-5-6-7-8-9-10^ 3-9-1-7-5 ■ ' 

TTRLQNS0SE / RSTSft 

eowhwdnlhg/ W H E N W 

EINDCEASRV f > N R E A C 

DHUI0ARTAG UADR0 • ' 

LVI EILFILNj ILLFI 

FIGURE 42. 
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The subsequent steps are obvious. Here again in solving an unknown 

i 

example it would be necessary to test out various assumptions with 
respect to the dimensions of the rectangle before attempting to apply 
the method outlined. 

£. Whenever this simple relationship. between the width and depth 
of the rectangle obtains, that is, when one dimension is a multiple 
of the other, solution of a single cryptogram is relatively easy. , The 
reason for this is not hard to see. When the enciphering rectangle is a 
perfect square, every column of the rectangle is composed of letters 
which all come from the same row of the rectangle. Hence solution 
is in this case the same as though a false double transposition were in 
effect, with merely the columns and the rows of a single rectangle 
shifted about. When the width of the transposition rectangle is twice 
the depth, a column of the Dg rectangle contains half the letters 
appearing on one row of the rectangle; two columns therefore contain 
all the letters belonging in the same row of the rectangle. If the 
width were three times the depth, then three columns of the I) rectangle 
would contain all the letters belonging in the same row of the 
rectangle, and so on. When the width is half the depth, a column of 
the Dg rectangle contains all the letters appearing m two rows of tho 
rectangle; when the width is one-third the depth, a column of the 
D2 rectangle contains all the letters appearing in three rows of the 

rectangle, and so on. But when bhis multiple relationship no longer 

\ 

obtains, solution becomes more difficult because each column of the 
rectangle is composed of letters coming from several columns of the 
rectangle, in an irregular distribution. Solution is, of course, most 
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difficult when incompletely-filled rectangles are^used. However, 
although solvable, even in the case of a single message, the solution 

/ 

will not be dealt with in ‘this text. 

29. Concluding remarks on transposition systems. - a. Pure trans- 
position, that is, transposition by itself, without an Accompanying 
substitution or other means of disguise for the letters of the plain 
text, hardly affords sufficient guarantees for cryptographic security 
in .the case of a voluminous correspondence which must be kept really 
secret for any length of time. For no matter how complex the method, 
or how many transpositions may bo applied to the letters of a single 
message, sight must nevor be lost of the fact that when there are 
many messages in the same key there are bound to be two or more of 
identical length; and when this is the case the- type of solution de- 
scribed in Par. 26 may be applied to these cryptograms, the trans- 
position keys recovered, and then all other messages in the same key 

* 

translated. , 

b. Transposition methods are, from the cryptographic point of view, 
rather highly regarded because they are, as "hand methods" go, rather 
rapid in operation and usually quite simple. However, from their very 
nature they entail the disadvantage that a single-letter omission or 
addition may render their decryptographing difficult if "not impossible 

for the average cryptographic clerk. But from the standpoint of modern 

\ 

cryptography the principal disadvantage of transposition methods is 

) 

that they can be mechanized only with great difficulty— certainly with 
groater difficulty than is the case of substitution methods. Only ono 

1 

or two attempts have been made to produce machinery for effecting trans- 
position, and these have not been successful. 
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SECTION VI 

MISCELLANEOUS TRANSPOSITION CIPHERS 

Paragraph 



Special designs or geometric figures 30 

Revolving grilles 31 

Solution of example 32 

Concluding remarks on the solution of revolving grilles .... 33 

Indefinite or continuous grilles 34 



30. Special designs or geometric figures. - It is impossible 
here to 'elucidate and demonstrate by example all the methods which may 
be used for the solution of cryptograms produced by the many various 
types of transposition designs or geometric figures other than the 
rectangular ones thus far treated. Reference may be made to such 
designs as triangles, trapezoids, and polygons of various symmetrical 
shapes. Most of these dosigns, howover, are impractical for military 
correspondence in any case, so that no attention need be given them in 
this text. If such designs were used, although it might be difficult to 
solve a single or oven a few messages m the same key, the general 
solution later to bo described is applicable whenevor two or more 
messages of identical lengths but in the seme key are available for 
study. Since most of these designs are of a fixed or inflexible 
character with regard to the number of letters that can be accommodated 
with one application of the design to the plain text to be enciphered, 
the production of several cryptograms of identical length in the same 
key is by no means an unusual circumstance. Thore are, however, one or 
two methods which do warrant discussion in this text, the most important 
being thoso which use grilles of the revolving,^ or continuous types. 

■^See Special Text No. 166, Advanced Military Cryptography, Sec. V. 




REF ID : A56913 



31. Revolving grilles. - a. In this type of grille apertures are 
distributed among the cells of a square sheet of cross-section paper 
in such a manner that when tho grille is placed upon a grid (a sheet of 
cross-section paper of the same size as the grille) and turned three 
times successively through angles of 90 ° from an initial position upon 
the grid, all the grid cells (or all but the central grid cell) are 
disclosed in turn. Correspondents must, of course, possess identical 
grilles and they must have an understanding as to its initial position 
and direction of rotation, clockwise or counterclockwise. There are 
two procedures possible in using such a grille. (1) The letters of the 
plain text may be inscribed successively in the grid cells through the 
apertures disclosed by the grille; when tho grid has been completely 
filled tho grille is removed and the letters transcribed from the. grid 
according to a prearranged route. (2) All the letters of xhe plain 
text may first be inscribed in the grid cells according to a prearranged 
route and then the grille applied to the campletely-fillod grid to 
give the sequence of letters forming tho cryptogram. The two methods 
of using the grille are reciprocal; if the first described method is 
used to encipher a message, the second method is used to deciphor the 
cryptogram, and vice versa. The first of the two above-described 
methods, the one in which the plain text is inscribed through the 
apertures, will here be referred to as tho alpha method; the second 
method will be referred to as the beta mothod. 

b. Tho number of letters in a cryptogram enciphered by such a 
device is either a perfect square, when the grille has an even number of 
cells per side, or is 1 less than a 'perfect squaro, when the grille has 
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an odd number of cells per side,' in which case the central cell of 
the grid is not disclosed and hence remains unfilled. ^ 

_c. The maimer of construction and the method of use of a grille 
entails certain consequences which can be employed to solve the 
cryptograms and to reconstruct the grille itself. The student who 
wishes to get a thorough grasp of the underlying principles to be ex- 
plained will do well to prepare a grille^ and study the properties which 
characterize cryptograms produced by its use. Three principles will be 
brought to bear in the solution of grille ciphers of this type and they 
will be demonstrated by reference to the grille and message shown in 
Fig. 43. 

d. The first principle may be termed that of symmetry . When a 
rovolving grille is in position 1 a certain number of cells of the under- 
lying grid are disclosed (uncovered) . For each such disclosed cell of 
the grid there is a symmetrically corresponding cell on tho same grid 
which is disclosed when the grille is turned to positions 2 , 3, and 4 , 
because the aportures of the grille remain fixed — only their positions 
change as the grille is turned in the process of enciphenoont. Now two 
successive apertures in position 1 will of course be occupied by a 



2 

Of course, the cryptogram may consist of the letters produced by 
several applications of the same grille. For example, if a message of 

— - - - - -* ^ f. 
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plain-text digraph (alpha method of encipherment). When the grille 
reaches position 3* after a turn of 180°, the two apertures concerned 
will disclose two cells which will also be occupied by a plain-text 
digraph, but the letters composing the digraph vail be in reverse order 
in the plain text . This property is true also of two successive 
apertures in position 2 when they turn up in position 4* Let the student 
verify this by moans of the grille which he has constructed. Thus, 
referring to Fig. 43, at A is shown the grille in position 1. In the 
first row are shown 2 apertures, ax coordinates 1-4 and 1-3. At B arc 
shown the results of the first application of the grille to the grid. 

Note the letters YO (first 2 letters of message) in cells 4 and 8. Now 
noto that tho symmetrically corresponding cells disclosed when the 
grille is in position 3 are cells 57 and 6l and those correspond to 
cells 4 and 3 in the reverse order. The letter T m cell 57 therefore 
symmetrically corresponds with letter 0 in cell 8; the letter Y in cell 
6l corresponds with letter Y in coll 4- The same is true of all other 
lotters m positions 1 and 3* As a consequence of this property of 
grilles, a single cryptogram can be handled as though it were really two 
cryptograms of identical length, having certain characteristico by means 
of which an assumption made in one text may he verified by what it yields 
in the other text. That is, when the cryptogram is transcribed as a 
series of letters in one line and the same text is written in another 
line under these letters but in revorsed order, then the superimposed 
lettors vail bear tho symmetrical relationship pointed out in this 
paragraph. If two letters m the upper line of such a transcription are 
taken to form a digraph, tho two corresponding letters in the lower line 
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must form a digraph but in reversed order in the plain text. For 

example, if the cryptogram of' Fig. 43 is written out as explained above, 

the result is as shown at Fig. 44* Now the presence of the Q in position 

12345678 9l0213233]415i6l7B]9 2>a-22ga h 3 2)2?S^3D3I32 
OOMYUCHOMUE LA ENLFHAIRLHERIDEPGEO 
SETYYBCTUSSIOERHTTUOTUCSEQEEHTST 

3334 3 S6373&3? ip £ & 434W5 4* 4748 43 SO % 52 53 2 55 56 5758 39 & & 626364 

TSTHEEQESCUTOTJTTHREOISSUTCBYYTES 

0EGPNDIRENLR.IABFLNRALEUM0HCTJYM-00 

FIGURE 44* 11 - 

39 suggests that it be combined with a U. If the TJ in position 43 is 
taken then the symmetrical digraph corresponding to QU would be LI; if 
the U in position 56 is taken, the symmetrically corresponding digraph 
would be 111. Furthermore , two -apertures which are in the same column 
and which do not have an intervening aperture between them , will yield a 
good digraph in all 4 positions of tho grille. For example, note 
apertures 2-6 and 3-6 in Fig. 43-A. When, the grille is turned to posi- 
tions 2, 3> and 4 they will disclose two sequent letters m each case. 

An analysis of the syxnmetries produced by an 8 x 8 grille yields the 
following table,. which shows what cells are. disclosed in the other 3 
positions when an aperture is cut in any one cell in one of the four 
positions of the grille. For example, an aperture cut in cell 11 
(position 1) will disclose grid cell 23 when the grille takes position 
2, grid cell 54 when tho grille takes position 3> and grid coll 42 when 
the grille takos position 4. 
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FIGURE 45* 

e_. The second principle may be termed that of exclusion . On 
account of the system upon which the construction of a revolving grille 
is based, a knowledge of the location of an aperture in one of the bands 
brings with it a knowledge of 3 other locations in which there can be no 
apertures. For example, referring to Fig. 43”A, the presence of the 
aperture at coordinates 1-4 precludes the presence of apertures at 
coordinates 4-8, 8-5, and 5-1. By virtue of this principle of exclu- 
sion, the number of possibilities for choice of letters in solving a 
cryptogram prepared by means of a revolving grille becomes much re- 
duced and the problem is correspondingly simplified; as will be seen 
presently. 

f. The third principle may be termed that of sequence . When try- 
ing to build up text, the letters vdiich follow a given sequence of 
plain-text letters will usually be found to the right and below, that is, 
if the normal method of writing was used (left to right and from the top 
downward) . For example-, referring to Fig. 44, if the trigraph Q, U E 
■ is to be built up, neither the TJ in position 5 nor that in position 10 
is very likely to bo the one that follows the Q; the U in position 43 is 
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the most likely candidate because it is the first one beyond the Q. 
Suppose the U in position 43 is selected. Then the E for Q, U E cannot 
be the one in position 40, or in any position in front of 40, since the 
E must be beyond the U in the diagram. 

v. 

£. In solving a grille, it will be found advisable to prepare a 
piece of cross-section paper of proper size for the grille and to cut 

i 

each aperture as soon as its position becomes quite definite. In this 
way not only will the problem be simplified but also when completed the 

f 

proper grille is at hand. 

32. Solution of example. - a. Suppose the cryptogram at Fig. 

43~G is to be solved. It ha3 64 letters, suggesting a grille 8x8. 

The cryptogram is- first transcribed into a square 8x8, yielding what 

1 

has already been obtained as Fig. 43-F. The Q in position 39 suggests 
that it is part of a word inscribed when the grille was in position 3, 
since there will be 16 plain-text letters inscribed at each position of 
the grille. Then a piece of cross-section paper is prepared for making 

1 

the grille as shown in Fig. 45~A, and on aperture is cut'm the proper 
position to disclose, in position 3. cell 39* It will be found that 
this is the aperture located at coordinates 4-2 of the grille shown in 
Fig. 45-A. At the 3ame time the other 3 cells numbered 4 in the 2d 
band of the grille are marked so that they cannot become apertures. The 
result is shown in Fig. 45-B. Conforming to the principle of sequence, 
the U to be combined with the Q, is sought to the right of the Q in 
Fig. 43“®' • There are threo candidates, in positions 43* 46 and 36. 

They yield : 
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{ Grille in position 3-) 
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39 43 29 46 39 56 

Q U Q U Q U 

I L I A I M 

( = L I p ) (z A I p ) (r M I p ) 

All of the symmetrical correspondents of these 3 QU*s are good digraphs 
and it is impossible to eliminate any of the three alternatives. The 
U in position 43 would place an aperture at coordinates 6-3 in Fig* 

45"B; the U in position 46 would place an aperture at coordinates 6-6; * 
and the U in position 56 would place an aperture at coordinates 7-8. 

All of these are possible, none being excluded by principle 2. Suppose 
the Q U is followed by E. There are only t wo possibilities: an E in 
cell' 31 and an E in cell 63* The following possibilities are presented: 
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None of the symmetrical correspondents of the Q, U E*s are impossible 
sequences in plain text, although 0 A I is not as probablo as the others. 
(The 0 could be the end of a word, the AI the beginning of the word AID, 

1 

s 

* 

AIM, AIR, etc.) Each of these possibilities would bo tested by princi- 
ple 2 to see if any conflicts would arise as to the positions of aper- 
tures. As in all cases of transposition ciphers, the most difficult 
part of the solution is that of forcing an entoring wedge into the struc- 
ture and getting a good start; when this has been done tho rest is easy. 
Note what the results are when the proper apertures are assumed for 
QUEST in this case, as shown in Fig. 45”C. In position 1 this yields 
OUR LI ...; in position 2 it yields two digraphs AN and UT; in position 
4 it yields two digraphs HA and RO. "The student should note that the 
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indicated digraphs AN and RO in 
positions 2 and 4, respectively, are 
certain despite the fact that there is 
a space between the two apertures dis- 
closing these letters, for the principle 
of exclusion has permitted the crossing 
off of this cell as a possibility for an 
aperture. 

b_. Enough has been 3hown of the 
procedure to make further demonstration 
unnecessary. Given the sequence OUR LI one begins to build on that, as- 
suming a word such as LINE. This yields possibilities for the place- 
ment of additional aportures in the grille; these are tested in positions 
2, 3, 4i and so on. When any 16 consecutive letters of plain text have 
,'been established all apertures have been ascertained and the problem 
has been complotod. Subsequent cryptograms prepared by the same grille 
can be read at once, 

c. If attempts at solution on the basis of the alpha method of 
uaing a grille have failed, the obvious modifications in procedure on 
the basis of tho bota method can readily be made. 

33. Concluding remarks on the solution of revolving grilles. - 
ja. There is nothing about the mechanics of revolving grillos which pre- 
vents their employment in enciphering complete words instead of individual 
letters. Howover, tho assembling of whole words in intelligible sequences 

and thus the reconstruction of the original plain text is a much easier 

\ 

matter than assembling single letters to form the words of the original 
plain text. 
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(Grille in position 3) 
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_b. In case the same grille^ has been employed several times with 
separate grids to encipher a message that is considerably longer than a 
single grid will accommodate (see footnote 2, Par. 31b) » the several 
sections each representing the set of letters enciphered on one grid 
may be superimposod and the general solution described in Paragraph 28 
may then be applied. 

c. In case the capacity of a grille is in excess of the number 

required by the length of the text to be onciphered, either of two pro- 

* [ 

cedures may be agreed upon. The grid cells which would otherwise be 
unoccupied may be filled by nulls, or the grid may be left incomplete. 

As regards the former procedure, little more need be said than that the 
presence of a few nulls will only delay solution a bit until the fact 
that nulls are being employed for this purpose becomes established. But 
the second typo of procedure calls for more ccmmont. If the grid is to 
be loft incomplete it is necessary, before applying the grille, to count 
the number of plain-text letters and to cancel from the grid a number of 
cells equal to the number of cells in excess over the total number re- 
quired. The position of the cells to bo cancelled must be agreed upon; 
commonly they are thoso at the end of the grid. Such cells are marked 
so that when they bocome exposed during the rotations of the grille they 
will not be used. Thus, for example, the grille shown in Fig. 43-A is 
intended for a grid of 64 letters; if the message to be enciphered con- 
tains only 53 letters, 12 cells of the grid must bo cancelled, and by 
agreement they may be cells 53 "to 64» 'inclusivo. The solution of a 
single cryptogram of this sort, or oven of several of them of differont 
lengths, may become a rather difficult matter. First of all, duos as to 
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the dimensions of the grille are- no longer afforded by the total number 
of letters in the cryptogram, so that this infoxmation can -be obtained 

■* I a- 

only by more or less laborious experimentation. Grilles of various 

* - — 

dimensions ;must be assumed, one after the other, until the .correct 

i 

dimensions have been found. In the second place, the symmetrical relation** 
ships pointed out in Paragraph 31 no longer -obtain, so that a single 
cryptogram cannot be handled as though it were constituted of tyro mes- 
sages of identical length., Of course, in trying out any assumed 
dimonsions, the 64 letters of the cryptogram may be written out in two 
superimposed linos, blanks being left for those positions which are 
unfilled. The procedure then follows the normal linos. About the most 
hopeful clues would be obtainod from a knowledge of the circumstances 
surrounding the transmission and affording a basis for the assumption 
of probable words. However, were such a system amployod for regular 
communication there would undoubtedly be cases of cryptograms of idontical 
lengths, so that the type of solution given in Paragraph 28 will be 
applicable. Once a solution of this sort has been obtained, tho 

1 

dimonsions of tho grille may be ascertained. Subsequent cryptograms may 
then be attacked on the basis of the noxmal procedure , with such modifica- 
tions as are indicated by tho absence of the number of letters needed to 
make a completely-filled grid. 

34* Indefinite or continuous grilles. - a. In his manual of 
cryptography, Sacco illustrates a type of grille which he has devised and 
which has elements of practical importance. An example of such a grille 
is shown in Fig. 46. This grille contains 20 columns of cells and each 
column contains 5 apertures distributed at random in the column. 
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FIGURE 4 6. 



There are therefore 100 apertures in all and this is the maximum 
number of letters which may' be enciphered in one position of the grille. 
The plain text as inscribed vertically, from left to right, using only 
as many columns as may be necessary to inscribe the complete message. 

A 25-letter message would require but 5 columns. To foim the crypto- 
gram the letters arc transcribed from the rows, taking the letters from 
loft to right as they appear in the apertures. If the total number of 
letters is not a multiple of 5» sufficient nulls are added to make it so. 
In de cryptographing, the total number of letters 10 divided by 5i this 
giving the number of columns employed. The cipher text is inscribed 
from left to right and top downwards in the apertures in the rows of 

1 

the indicated number of columns and the plain text then reappears in 
the apertures in the columns, reading downward and from loft to 'right, 
b. Such a grille can assume 4 positions, two obverse and two 
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reverse. Arrangements must be made in advance as to which positions 
will be employed. 

c. The solution of a single cryptogram enciphered by one and 
only one position of such a grille presents a hopeless problem, for the 
apertures being distributed at random throughout the grille there is 
nothing which may be seized upon as a guide to the reconstruction of 
either the grille or the plain text. It is conceivable, of course, 
that a person with an infinite amount of patience could produce an 
intelligible text and a grille conformable to that text, the grille 
having a definite number of columns and a fixed number of apertures 
distributed at random throughout the columns. But there would be no way 

■L 

of proving that the plain text so obtained is the actual plain text 

that was enciphered; ' for it would be possible to produce several "solutions" 

of the same character, any one of which might be correct. 4 

d. However, suppose a grille of this sort were employed to en- 
cipher a long message, requiring twooor more applications of the grille. 

For example, in the case of the grille shown in Fig. 46, having a 
capacity of 100 letters per application, suppose a message of 400 letters 
were to be enciphered, requiring two obverse and two reverse applications 
of the grille. It is obvious that symmetrical relationships of the 
nature of those pointed out in Paragraph 31 can be established. Of 
course, if the grille is used several times in the some position to its 
full capacity, producing cryptograms of multiples of 100 letters, then the 



In this connection, see JUilitary Cryptanalysis, Part III, 
Sec. XI, footnote 3 . 
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sections of 100 letters may be superimposed and the solution in Paragraph 
28 applied. 

e,. If the grille shown in Pig. 46 were used to encipher two mes- 
sages, one of 80 letters,, the other of 85 , it would be possible to 
solve these messages. For by eliminating 5 letters from the longer 
message, the two cryptograms can be superimposed and handled as in Para- 
graph 28. The difficulty would be in finding the 5 extra letters. Of 
course, if it should happen that one of the messages required 3 or 4 
nulls and letters such as J, X or Z wbre employed for this purpose, the 
nulls would be likely characters for elimination. But regardless of 
this, even if letters of' medium or high frequency were used as nulls, 
patient experimentation would ultimately lead to solution. The latter, 
it must be conceded, would be difficult but not impossible. 
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SECTION VII 

COMBINED SOBSTITOTI ON-TRANSPOSITION SYSTEMS 

Paragraph 

Monoalphabetlc substitution combined with transposition 35 

Other types of combined substitution-transposition systems .. 36 

•■i 

35 . Monoalphabetic substitution combined with transposition. - 
a. A message may undergo monoalphabetic substitution and the resulting 
text passed through a simple transposition. Yihen this i3 the case a 
uniliteral frequency distribution will, of course, exhibit all the 
characteristics of monoalphabeticity, yet the cryptogram will resist 
all attempts at solution according to straightforward simple substitution 
principles. It is usually not difficult to detect that a transposition 
is involved because there will not only be long strings of low-frequency 
letters or high-frequency letters but what is more important, there will 
be very few or no repetitions of digraphs, tri graphs, and tetragraphs, 
since these will be broken up by the transposition . When a unilitoral 
distribution presents all the external evidences of monoalphabeticity 
and yet there are no repetitions, it is almost a positive indication 
of the presence of transposition superimposed upon the substitution, or 
vice versa. (The former is usually the case) . 

jb. When confronted with such a situation the cryptanalyst usually 
proceeds by stages, first eliminating the transposition and then 
solving the monoalphabet . It is of course obvious that the general 
solution for transposition ciphers (cryptograms of identical length m 
the same key) will not be applicable here, for the reason that such a 
solution i3 based upon anagramming, which in turn is guided by the 
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development of good digraphs tri graphs , and polygraphs. Since the 

i 

letters of a combined substitution-transposition cipher are no longer 
the same as the original plain-text letters, anagramming of columns 
formed by superimposing identical-length cryptograms can yield no 
results, because there is nothing to guide the cryptanaylst in his 
juxtaposition of col umns . 

_c. Of course, if it should happen that the substitution process 
involves known alphabets, the cryptanalyst can remove the effects of the 
substitutive process before proceeding to eliminate the transposition, 
even xf in the encipherment the substitution came first. For example, 
if a standard cipher alphabet were jamployed for the substitution the 

C 

uniliteral frequoncy distribution would give indications thereof and 
the cipher letters could immodiately be converted to the normal plain- 
text equivalents. The latter may then be studied as though merely 

F 

transposition-had been applied. . But if unknown mixed cipher alphabets 
were employed, this initial comparison .can not be accomplished and a 
solution must wait upon the removal of the transposition before the 
substitution can be attacked. 

d. Of course, if nothing is known about the system of transposition 
that has been employed, there is hardly 'anything to do but experiment 
with various types of transposition in an attempt to bring about such 
an arrangement of the toxt as will show repetitions. If this can be 
done, then the prob]em can be solved. For example, suppose that a 
message has beon enciphered by a single mixed cipher alphabet and the 
substitution text has then been inscribed within a rectangle of certain 
dimensions according to one of the usual routes mentioned in Paragraph 5« 



A 



s 







4 * 
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Repetitions in the plain text will of course be preserved in the 
substitution text but will be destroyed after the transposition has 
been applied. The cryptanalyst, however, m his attempts to eliminate 
the transposition may experiment with route transpositions of the 
various types, employing rectangles of various dimensions as suggested 
by the total number of letters in the cryptogram. If he perseveres, 
he will find one route which he will know is correct as soon as he 
tries it because it will disclose the repetitions in the plain text, 
although the latter are still covered by a substitution. 

e. Practically all the methods of transposition which may be 
applied to plain text may also be applied to a text resulting from an 
initial transformation by substitution. As already mentioned, route 
transposition may be used; reversed and rail-fence writing, columnar 
transposition with or without keying and with complete or incomplete 
rectangles are also possible. Prom a practical standpoint, keyed 
columnar transposition applied to a monoalphabctic substitution is not 
only a popular but also a fairly secure combination because in this case 
the elimination of the transposition is a rather difficult matter. If 
the rectangle is completely filled the problem is not insurmountable 
in the case of a long message transposed by means of transposition with 
a rectangle of fairly small dimensions. For by assuming rectangles of 
various dimensions suggested by the total number of letters, cutting 
the columns apart, and then combining columns on the basis of the 
number of repetitions produced within juxtaposed columns and between 
different sets of juxtaposed columns, it is possible to reconstruct the 
rectangle and thus remove the transposition phase. This, however, Is 
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1 



admittedly a slow and difficult process even under the most favorable 

# 

« * 

conditions; and if the rectangle is incompletely filled the process 

is practically futile. For in the latter case the lack of absolutely 

i 

clear-cut knowledge as to the lengths of the columns , the juxtaposition 
of columnar material becomes replete with uncertainties and engenders 

J 1 

feelings of confusion, hopelessness, and inadequacy in the mind of the 
cryptanalyst. However, he need not be wholly in despair if he is 
confronted with a problem of this nature in war time, when many crypto- 
grams become available for study. For there are special methods of 
solution suitable to the occasion, created by special circumstances * 
attendant upon the interception of a voluminous traffic. In subsequent < 
paragraphs the student will come to understand what is here meant by 
the special circumstances and will learn of these special solutions. 

36. Other types, of combined substitution-transposition systems. - 

„ 1 * .■ 

a. There is no technical obstacle to the application of a transposition 
to the text resulting from any type of substitution, even if the latter 
is polyalphabet ic or polygraphic in nature. Tho obstacles or rather 

1 

objections to such combinations are practical in thoir character — they 
are too complex for ordinary use and the prevalence of errors makes 
them too difficult to handle, as a general rule. However, they have 
been and are sometimes used even as field ciphers. For instance, on 

I the southeastern front during the World War the Central Powers made 

use of a somewhat Irregular polyalphabetlc substitution involving 4 
standard alphabets and a keyed columnar transposition with incompletely 
filled rectangles of a relatively large number of columns. Nevertheless, 
messages in this system were solved by taking advantage of the possibility 
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b. Digraphic substitution, such as the Playfair cipher, may be 
combined with transposition to yield cryptograms of fair security. But 
here again the • elimination of the transposition phase by taking advantage 
of special circumstances or by rearranging tho text so as to uncover 
the repetitions which are inevitable in the Playfair cipher, will result 
in solution. 

£. A particularly fruitful source of combined substitution- 
transposition is to be found in those methods generally designated as 
fractionating systems, wherein tho substitution phase replaces each 
plain-text letter by an equivalent composed of two or more components or 
"fractions" and then these components are subjected to transposition in 
a second phase. This latter may be followed by a third phase, recom- 
bination of distributed components, and a fourth phase, the replacement 

i 

of the recombined components by letters. Thus such a system comprises a 
first substitution, a transposition, a recombination, and a second 
substitution. In the subsequent paragraphs certain systems of this 
sort will bo dealt with in detail. ,Thoy are interesting examples of 
practical systems of cryptography which have boon used m the field of 
military operations m the past and may again be used m the future. 

The first one to be discussed is particularly interesting for this 
reason alone; but it is also of interest because it will serve as a 
model for the student to follow in his study of methods for the solution 
of combined substitution-.transposition ciphers in general. 
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37* Introductory remarks. - a. One of the most interesting and 
practical of the many methods in which substitution and transposition are 

T I 

combined within a single system is that known in the literature as the 

i " - 

ADFGVX cipher. In this system a 36-character bipartite substitution 

i 

k 

checkerboard is employed, in the cells of which the 26 letters of the 
alphabet and the 10 digits are distributed in mixed order, often ac- 
cording to same keyword. The row and column indicators (coordinates) 
are the letters ADFGVX, and taken in pairs the latter are used as 

substitutes for the letters of the plain text. These substitutive 

% 

pairs are then inscribed within a rectangle and a col umnar transposition 

- i 

takes place, according to a numerical key. The cipher text consists 

i 

m r — 

then merely of the 6 letters A, D, F, G, V, and X. 

. hi 

b. The ADFGVX cipher system was inaugurated on the' Western Front 
by the German Army on March 1, 1918, for communication between higher 
headquarters, principally between headquarters of divisions and corps. 
When first instituted on March 1, 1918, the checkerboard consisted of 
25 cells, for a 23-letter German alphabet ( J was omitted), and the 5 



■^Special Text No. 166, Advanced Military Cryptography, Sec. XI. 
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letters A, D, F, G, and X used as coordinates. On June 1 the letter V 
was added, the checkerboard having been enlarged to 36 cells, to take 
care of a 26-letter alphabet plus the 10 digits. Transposition keys 
ranged from 15 to 22 numbers (inclusive) and both the checkerboard and 
the transposition key ware changed daily. The number of messages m 
this system varied from 25 a day upon the inception of the system to as 
many as 150 per day, during the last days of May, 1918. The first 
solution was made on April 6 by the French. The cipher continued in 
use rather extensively until late in June but from that time until the 
Armistice the volume of messages diminished very considerably. Although 
only 10 keys, covering a period of as many days were ever solved, the 
proportion of solved messages in the whole intercepted traffic was 
about 5036. This wa3 true because of the fact that the keys solved were 
those for days on which the greatest number of messages was intercepted. 
The same system was employed on the southeastern front from July, 1918, 
to the end of the war. Keys were in effect at first for a period of 2 
days and beginning on September 1, for a period of 3 days. In all 17 
keys, covering a total of 44 days, were solved. 

c. At the time that the Allied cryptanalytic offices were working 
with cryptograms in this system only three methods were known for their 
solution and all three of them are classifiable under the heading of 
special solutions, because certain conditions had to obtain before they 
could be applied. No general solution had' been developed until after 
hostilities had ceased. Because they are interesting and useful same 
attention will be devoted to both the general and the special solutions. 
Since the special solutions are easy to understand and serve as a good 
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Introduction to the general solution, they will be taken up first. 

38. Special solution by means of identical endings. - a. In Par. 

i 1 r 

* “ 

24 it was demonstrated how the solution of keyed columnar transposition 

‘ \ 

1 , 

ciphers can be facilitated and simplified by the comparison of two crypto- 

grams which are in the seme key and the plain-text endings of which are 

. ^ ■ 

identical. It was noted in that case that a stufy of tho irregularly 

1 

distributed cipher-text identities between the two cryptograms permits 
of not only cutting up the text into sections that correspond with the 
long and the short columns of the transposition rectangle but also of 
establishing the transposition key in a direct manner almost entirely 
mathematical in nature. lNhen this has been accomplished the plain 
texts of these two messages are at once disclosed, and all other mes- 
sages in the same key may be read by means of tho key so reconstructed. 

b. The same method of solution is applicable to the similar 
situation, if it can be found, in the case of the ABFGVX system, except 
tliat one more step Intervenes between the reconstruction of the trans- 
position rectangle and tho appearance of the plain text in the rectangle: 
a monoalphabet ic substitution must be solved, since the text in the 
rows of the rectangle does not consist of plain-text letters but of 
pairs of components representing these letters as enciphered by means 

of a bipartite substitution alphabet. Moreover, this latter step is 

' 

comparatively simple when there is a sufficient amount of text in the 
two rectangles; if not, additional material for use in solving the 
monoalphabet can be obtained from other cryptogram^ in the same key, if 
they are available, since the transposition key, having already beon 
reconstructed from the two cryptograms with identical endings, will 
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penult of inscribing all other cryptograms in the same key within their 
proper rectangles. 

c. A demonstration of the application of the principles in- 



volved in eudi a solution will be useful. The following cryptograms 
have been intercepted: 



No. 1 



I V A A X 
XVAVF 
A A D D D 
AFAFX 
DDFAG 
D X 



V D D A G 
A V X A D 
XDA7G 
FFXFX 
TFAD7 



D A D V F 
G F F X F 
G A A D X 
F V D G X 
F A V V X 



A D A D A 
F G A G F 
A D F V F 
A F F G X 
G V A A A 



F X G F V 
KDGD 
F D F X F 
A A A V A 
F D F A X 



X F A X A 
D G A F D 
G F G A V 
V A F A G 
X F A A G 



No. 2. 



F D F F F 
G A X G D 
V G V F F 



F V F A D 
V X G F X 
F D A F F 



D V F V D 
V X D X V 
F X D A F 



G A F D F 
A A A A D 
X G A F D 



D A G A D 
G X F F D 
V F G X V 



F D F A F 
V F A A G 
D D F A D 



DAAAX AAFFA F V F X F FAXXA XDGXA VDAVF 

DFAVX VADXF A X F F. X X A A V X XADXA A A V V G 

AGDXX FDFAX FDGDF FXDGX FAGDF FDDVD 

DXDAF A G X X A F G A V 

d. ' The delimitation and marking of identities between these two 
cryptograms is a procedure similar to that explained in Par. 24b.» 
except that a little more study may be necessary in this case because 
occasionally there may be considerable uncertainty as to exactly where 
an identity begins or' ends. The reason for this Is not difficult to 
understand. Whereas in Par. 2/*b the process involves "unfractionated" 
letters and there are about 18 or 20 different letters to deal with, 
so that an "accidental identity" is a rather rare occurrence, in the 
presont problem tho process involves fractions of letters (the com- 
ponents of the bipartite cipher equivalents) , and there are only 6 



different characters to deal with, so that such "accidental identities" 
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are quite frequent. Now the cryptanalyst is not able at first to 
distinguish between these accidental Identities and actual identities 
and this is what makes the process somewhat difficult. What is meant 
will become perfectly clear presently. 

e. Taking the two illustrative cryptograms, the first step is to 
ascertain what identities can be found between them, and then mark off 
these identities. For example, it is obvious that if the messages end 

, t 

f 

alike the last several letters in No. 1 should be found somewhere in 
No. 2, and likewise the last several letters in No. 2 should be found 
somewhere in No. 1. The number of letters in identical sequences will 
depend upon the length of the Identical text and the width of the trans- 
position rectangle. Searching through No. 2 for a sequence such as 
AGEK, or GBX, or at least UX, the tetragraph AGEK is found as letters 
151-54. The last column of No. 2 ends with FGAV; searching through 
No. 1 for a sequence FGAV, or GAV, or at least AV, the tetragraph 
FGAV is found as letters 87~90* These identities arc underlined or 
marked off in some fashion, and search is made for other identities. 

It would be a great help if the width of the transposition rectangle 
were known, for then it would be possible to cut up the text into 
lengths approximately corresponding to column length's , and this would 
then restrict the search for identical sequences to those sections 
which correspond to the bottoms of the columns. Suppose the key to 
contain 20 numbers. Then the roctanglo for No. 1, containing 152 
letters, would consist of 12 long columns of 8 letters and 8 short ones 
of 7 letters; that for No. 2, 'containing 194 letters, would consist of 
14 long columns of 10 letters and 6 short ones of 9 letters. If that 
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* 



were correct then in No.. 1 the end of the first column would be either 
XVDD, or XVD. Searching through Ho. 2 for either of these a sequence 
XVDD is found as letters 84-7. Column 1 is probably a long column in 
No. 1. The word probably is used because the identity may extend only 
over the letters XVD, and the next D may be an accidental similarity, 
since the chances that D will appear by pure accident are 1 in 6, which 
is not at all improbable. It must also be pointed out that a certain 
number of telegraphic errors may be expected, and since there are only 
6 different letters the chances that an F, for example, will be re- 
ceived or recorded as a D are fairly good. Column 1 of No. 2 ends 
either with VFAD or VFA. Searching through No. 1, a sequence VFAD is 
found as letters 14*17; a sequence VFA is found as letters 34*6; a 
sequence VHFD is found as letters 79*82; a sequence VFAD is also found 
as letters 126-130; a sequence VFA is found as letters 131-3* Here are 
several possibilitios; which is the one to choose? Two of these 
possibilities coincide exactly with the full sequence being sought, 

VFAD. One of them is at 14-17, but this is rather unlikely to be the' 

.* 

correct one. For if an hypothesis of a key of 20 columns is assumed, 
as has here been done, then column 2 must contain either 8 or 7 letters 
and to assume VFAD in positions 14-17 would make column 2 a column of 
9 letters, which is inconsistent with that hypothesis. The other VFAD 
sequence, at 126-30, remains a candidate, since at this stage it is 
not possible to tell just where the ends of the columns are, and there 
is therefore nothing to indicate that this possibility may be ruled out. 
Another section of the text of one or the other cryptogram is selected, 
with a view to establishing additional identities. To go through the 



- 119 * 



REF ID : A56913 



whole process here would consume too much space and time. Moreover, 
it is not necessary, for the only purpose in carrying the demonstration 
this far is to indicate to the student the general procedure and to 
show him some of the difficulties he will encounter in the identifies* 

• t 1 — t ' - i 

i i 

tlon of the similar portions when the text Is composed of only a very 

i 

limited iiumber of different letters. In this case, after more or less 

tedious experimentation,, .the hypothesis of a key of 20 columns is es- 

tabllshed as correct, when two sets of 20 identities are uncovered and 

the identities are found to be as shown in Fig. 47* 

f . A table of equivalencies is then drawn up: 

No. 1 .1 2 3 4 5.6 7 6 9.10 11 12 13 14 15 16 17 18 19 20 

■No. 2 96 8 10 13 11 17 2 19 15 '7 20 14 12 5 18 1 4 3 16 

Since the rectangle for No. 2 has 2 more letters in the last row than 

the rectangle for No. 1, two chains of equivalents at 2 Intervals are 

constructed. Thus: 

1—2—3 — 4 — 5—6— 7--B— 9-10-11-12-13-14— 15-16-17-18— 19-20 
I 9 19 3 6 2 6 11 7 I7 

4 10 15 5 13 14 12 20 16 18 

These chains must now be united into a single chain by proper inter* 

• < ' ' ‘ . 

locking. Since cryptogram No. 1 has 12 long columns, and since the 

identities of' these 12 columns are now known {1, 3, 5, 7, 9, 12, ±3, 

*> *-» 

14, 16,"17, 19 1 20), the Interlock jng of the two chains and hence the 

1 

transposition key must' be this: 

'1-2—3— 4-5— 6-7—8— 9-IO-II-I2-I3-H-I5-I6-I7-I8-I9-2O 
7-5-I7-I3-I-I4-9-I2-I9-20— 3*16—8*18— 2—4— 6-IO-II-I5 

&' The two cryptograms may now be transcribed into their proper 

transposition rectangles, as shown in Fig. 46. 



. - 120 - 



REF ID : A56913 



No. 1. 



5 


10 


15 


20 25 


30 


IVAA^ 


V D D| A G 


D A ,D V FI 


ADAiDA FXGlFV 


X F,A x a| 




1 


2 


3 


4 


35 


, 40 


45 


50 55 


60 


X V A V |F 


A V XlA D 


G F ,F X F| 


FGAGJT DGDlGD 


.DGAFDl 




5 


6 


7 


8 


65 


70 


75 


80 85 


90 


A A D,D D 


XDAJTG 


G AiA D XI 


ADFV.F FD|FXF 


G |F G A V) 




9 


10 


11 


12 


95 


100 


105 


110 115 


120 


A F A F (X_ 


F F XlF X 


F V P G X 


aIffgx iaaaIva 


V AiF A G 




13 


14 


15 


l6 


, 125 


130 


135 


, 140 145 


150 


g D F A G 


iV F A D| V 


F A V ,V X 


G| V A A A ,fdfa|x 


X F A jA_G 




17 


18 


19 





D X| 

20 

No. 2. 



5 


10 


15 


20 




25 


.30 


F D F F F 


F ,V F A D| 


D V F V |D 


G A F D| F 


D A 


GAD iF D F A| F 




1 




2 






3 


35 


40 


45 


, 50 




55 


1 60 


G A X G D 


,V X GIF X 


Y X D X V 


iA A A| A D 


G X 


F F|D V 


FJA A G 




4 




5 




6 




65 


, 70 


75 


80 




85 


90 


7 G Y F |F 


F D[ A F F 


F X p A F 


X G(A F D 


Y F 


G X. Y D 


DjF a d 




7 


8 






9 




95 


100 


105 


110 




115 


120 


D A A|A X 


a|a f f a 


F V jF X F| 


F A X X A 




G X A| V 


D A Y F 


10 




11 






12 1 




125 


130 


135 


140 




145 


150 


D |F A V X| 


V A B X F 


AjX F F X| 


x a a y X 


X jA_ 


D X| A A 


A V V G 


13 




14 






15 




155 


160 


165 


170 




175 


180 


|A G D XjX 


F D F A X 


iF D G D| F 


F X D G X 


iF A G D| F F 


D D V ,D 



17 18 



185 190 

D X D A| F A G X X A |F G A 
19 20 



FIGURE 47 
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7 537X3 131 932 39 2D 336 838 2 4 630115 
FXDAXFAF7XA7 G 7 A F A 7 A F 
G7FF7XAXAXDADFGVDGDF 
AAAAAFDFAFA7DADXGGFG 
G7GFA7DGAADAG7AFFA7X 
FF7XXDDFFAAFA7DAFAFA 
DAFF7GXGDGFAFX7XXDFA 
GVAFDXDAFDXGDGFAFX,DA 
DXDXDAA7AXGD 



7 5 17 33 1 34 9-32 39 2) 3 J6 SB 2 4 6IH5 
AFX7F7AFFFFAAFDFAFAX 
AXFDDAFAFADAFF7GDAFA 
G7DAFDDXDGAAFXFAGDFA 
'7XFVFX7XDXG7FD7XXDA7 
GDAFFFFA7XA7XGDGFAFX 
7XXDFAGXDADGDXGDFA7X 
F7FF7XXDDFFAAFA7DAFA 
FADA-FF7GXGDGFAFX7XXD 
FAG7AFDXDAFDXGDGFAFX 
DADXDXDAA7AXGD 



No. 1. 



No. 2. 



FIGURE 48* 



7 5 1713 134932392J 3 36 8 33 2 L 6 I) A 15 75 l7B13^932]9aD3J68382A6l)Ill5 

HA7EORDERE EXPECTENEM 
FXDAXFAF7XA7G7AFA7AF AFX7FVAFFFFAAFDFAFAX 



DCOMMANDIN 

G7FF7XAXAXDADFG7DGDF 

GGENERAL23 

AAAAAFDFAFA7DADXGGFG 

DBRIGADETO 

G7GFA7DGAADAG7AFFA7X 

COUNTERATT 

FF7XXDDFFAAFA7DAFAFA 

ACKWITHOUT 

DAFF7GXGDGFAFX7XXDFA 

DELAYWITHA 

G7AFDXDAFDXGDGFAFXDA 

L L A R M S 
D X D X D A A 7> A X G D 



KYATTACKAT 

AXFDDAFAFADAFF7GDAFA 

DAYLIGHTST 

GVDAFDDXDGAAFXFAGDFA 

l 

OPHOLDYOUR. 

7XF7FX7XDXG7FD7XXDA7 

•S"E C T 0 R W I T H 
GDAFFFFA7XA7XGDGFAFX 

OUTFAILSTO 

7XXDFAGXDADGDXGDFA7X 

t 

P.COUNTERAT 

F7FFVXXDDFFAAFA7DAFA 

TACKWITHOU 

FADAFF7GXGDGFAFX7XXD 

TDEX AYWITH 
FAG7AFDXDAFDXGDGFAFX 

A L L A R M S 
DADX'DXDAAYAXGD 



No. 1. 



FIGURE i 49 • 



No. 2. 
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h. A frequency distribution is now made of all the bipartite 
pairs, so as to solve the enciphering checkerboard. There is no neces- 
sity for going through this part of the solution, for it falls along 

quite normal lines of monoalphabet ic substitution. The checkerboard is 

2 

found to be as follows: 



A 

D 

F 

G 

V 

X 



A 


D 


F 


G 


V 


X 


G 




E 




R 


M 


A 




N 


I 




L 


T 


Y 


C 


2 


P 


H 




S 


B 


2 


D 


F 








K 




0 




u 


V 




X 





i_. The two plain-text rectangles are 
shown in Fig. 49. 

Speculating upon the disposition of 
the letters within the enciphering checker- 
board, it soon becomes evidont that the "key-phrase upon vdiich it is based 
is GERMAN MILITARY CIPHERS. The digits are inserted immediately after 
the letters A, B, C, ..., as they occur in the mixed sequence, so that 
the complete checkerboard is as» shown m Fig. 50: 



A D F G V X 



A 

D 

F 

G 

V 

X 



G 


S 


E 


AJ 




M 


A 


1 


N 


I 




L 


T 


Y 


TT 


I 




H 


7 


S 


B 


2 




F 






9 . 


T 




0 


JL 


U 


V 


w 




Z 



FIGURE 50. 



The transposition key vjas evidently derived 

from the first 20 letters of the mixed soquence: 

GEE MANIL T YCPHSBDFJ K 0 
7 - 5 - 17 - 13 - 1 - 14 - 9 - 12 - 19 - 20 - 3 - 16 - 8 - 18 - 2 - 4 - 6 - 10 - 11-15 

The data (20th) indicates that the transposition 



key vdll have 20 numbers :n it. 

39* Special solution by moans of identical beginnings. - 11 . In 
Par. 23 was demonstrated the method of solution based upon finding two 
cryptograms winch arc in tho sumo key and the plain texts of which begin 



^ince tho 1st cryptogram is addressed to tho CG 23d Brigade end the 2d 
cryptogram mentions that the coirr .under of thar brigade has been ordered 
to do so and 30, tho solution of the groups GG (= 2) and FG (=3) is 
mado b-r inference. This gives tho placement of these two digits m the 
cipher square. 
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with the same words. The application of this method to the correspond- 
-ing situation in the case of the ADFGVX system should by this time be 
obvious. The finding of identical sequences is somewhat easier in this 
case than in the case of identical endings because the identities can 
be found in parallel progression from the beginning to the end of the 
two cryptograms being compared. Moreover, the discovery of two crypto- 
grams with similar beginnings is easier than that of two with similar 
endings because in the former case the very first groups in the two 
cryptograms contain identitlos, whereas in the latter case the identi- 
ties ore hidden and scattered throughout the texts of the two cryptogram 
On the other hand, the complete solution of a case of identical endings 
is very much more simple than that involving identical beginnings be- 
cause in the former caso the establishment of the identities carries with 
it almost automatically the campleto reconstruction of the transposition 
key, whereas in the latter this is for from true and additional crypto- 
grams may be essential in order to accomplish this sine qua non for the 
solution. 

b_. The following represent 8 cryptograms of the same date, assumed 
to have been enciphered by the snmo key. The cryptograms have been 

No. t. 

V D D F A ZFAA1 D X G G F FVFXF GXDXG DGAGF 

AGDAD 7GGDA A A D X X DXAFF AADAF DFFDA 

No. 2. 

GXDDA DDGDF VGXAX XXGXG AAA AD FADDX 

AVDXF X AD 



l 
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X D A A A 
A F D A D 
X A X V A 
A D A F A 
G D X D 7 
F G 7 X D 
PFDXG 
A A G A G 
G A F V X* 
G A F F F 



A F G F X 
D G D X A 
G D 



X A A A D 
D A A X A 
X F D G G 



X D A A V 
G D F D A 
F D X A X 
G G F D D 
A D F F G 
D D D A V 
D X D V F 
X F D A G 
A F F A A 
V A X D A 
D G 



A G F G V 
D D A X X 
D V A X A 
D D A F F 
X D D V 



G X D D X 
G V G D V 
D X F X F 
X F A A G 
DADAV 
DGDDJ 
V G D F G 
A F D G X 
D G G F G 
G X A X D 



A G X A G 
F D X A X 



BGAAG 
GDXDX 
D A X D G 



D X D G F 
A A G A X 
G A X F F 
D V F F V 
D G F D A 
G A V A D 
F X V A X 
A G A V D 
F F F D V 
G A D X D 



D D D D F 
A A D D F 
X F X D A 
7 D G X A 



No 

V F F V D 
F D F X A 
D G A G F 

V A A G A 
D A D D D 
A F A G V 
A 7 A D A 
A F A F X 
D A A A F 
FDDFX 



No 

X D D A F 
G F G D D 



No 

D D D X F 
X X X D G 
ADFD 



No 

X V G D D 
D 7 F D F 

V D V A F 

V A G V A 
A F G A X 
F G D D F 
G F D A G 

V A G A F 
D F F A F 
7 F A F F 



No. 

D D F X F 
A G G F F 
F X D D G 
A D X F X 



3 -. 

G A D F D 
G F X A F 
G G A D D 
F D V D V 
G A D A G 
A F G X G 
X D A F A 
X G G A G 
D A D A D 
A A A A A 



4 . 

A A X A V 
V A D X A 



5 . 

F A V G A 
V F A D A 



, 6 . 

A V G X a 
D F F D D 
GVDTD 
X A A G G 
F F D V D 
F D G D V 
X F F F F 
D G D A V 
D A G D G 
F G D D A 



7 - 

D D G D F 
A X D D G 
F X G D V 
G V A D A 



X A A A G 
A F A X D 
A G D G X 
D X F D A 
A A A F G 
7 D D A X 
A F D G F 
A A F F A 
X 7 V A X 



GDDD1) 
X G F A X 



X D G G D 
DPFFF 



D X A A D 
FDDFX 
D D A G D 
X G X D D 
D D A G A 
D G G X A 
A A X D A 
7 D D D D 
F A A A F 
D D D F A 



A X F D D 
X D F A D 
G F F G X 
X G X A G 



D F A D G 
D D D F D 
A 7 G D G 
X F D F F 
G D X A X 
X D 7 F F 
7 F X X X 
A F D G A 
F 7 A D D 



F A F G 7 
F D A D D 



F F A 7 A 
7 7 G F D 



X G G A A 
F X X F D 
G G D A A 
D A D X F 
F A D A 7 
X A X D A 
F 7 D X G 
D F X G 7 
D X A X A 
G D F A X 



7 D 7 X A 
D F D G D 
D A D F A 
A G D G 7 
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No. 8 . 

D F G F X DF' AFP X D X A G A D G G G DDFGA XGVDF 
VVFDA A A X G D AVDVA DDGVD AFA& 

examined for identical beginnings, and numbers 3 and 6 apparently begin 

r 

alike, identical portions being underlined as shown. Now the number 
of identical sections in the two cryptograms is 15; this indicates that ^ 
the width of the transposition rectangle is 15* Therefore, No. 3 (290 

i 

letters) has 5 long columns of 20 letters and 10 short columns of 19 
letters: ^15 x 20) - 10 - 290J No. 6 (302 letters has 2 long columns 

of 21 letters and 13 short columns of 20 letters. ((15 x 21) - 13 i 3021. 
The identical sections in No. 3 and No. 6 having been marked off as 
shown in Fig. 51 « the next step ,1s to transcribe the texts into their 
correct column lengths as given by the study of identical sections, 
writing them merely in thoir serial order, as shown in Fig. 52. In this 
transcription no serious difficulty is usually encountered in the divi- 
sion into correct column lengths, this process being guided by the 
identical sequences, the number of letters between the identical 
sequences, and the maximum and minimum lengths of the columns as cal- 
culated from the dimensions of the rectanglo. Whenever difficulties are 
encountered in this process, they are brought about by accidental iden- 
tities of letters before and after the true or actual identical sequences. 
In the present case no such difficulties arise except in going from 
column 12 to column 13. The identical sections for column 13 here con- 
sist of the sequence A F F A A F; if these sections are placed at the 

head of column 13, it leaves column 12 one letter short at the bottom 

; 

in each diagram. This means that the initial A f s in these identical 
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No. 3. 





X D A A A 


G X D D X 


7 F F 7 D ' 


G A D F 


X A A A G 


D F A D G 




1 

A F D A D 


G 7 G,D 7 
D X F X F 


F D F X A 


G F X A F 


2 

A F A X D 


DDE F D 




X A X,7 A 


3 

D G A G F 


G G A ,D D 


A G D G.X 
5 

D X F D A 


4 

A 7 G D G 


* 


ADAFA 


X F A AG 


7 A, A G A 


F D 7 D 7 


X F D F F 




G D.X D V 


D A D A 7 


D A D D D 


G A J) A'G 
S 

A F G X G 


_A A A F G 


7 

G D X A X 




F G V X D 


D.GDDF 

9 

T G D E G 


A F A G 7 


7 D D A X 


I D 7 F F. 




F F D X G 


A 7 A D .A 
A F A F X 


X D A F, A 
11 

X G G A G 


A F D G F 


10 

7 F X X X 




A A G.A G 


AFDG.X 


A.A F F A 


A F.D G A 




G A F 7 X 


12 

D G G F G 


D .A A A F 


_D, a D A D 


13 

X 7 7 A X 


F 7 A D D 




G.A F F F 
15 

IDAA.V 


_G, X A X D 
D X D G F 


14 

F'DDFX 

No, 

X 7 G D D 


A A A A A 

. 6. 

A 7 G X A 


JJIAAD 


X G G A A 




1 

G D F D A 


A A G A X 


,D 7 F D F 

3 

7 D 7 A F 


D F F D D 


2 

F D D F X 


F X X F D 


- 


,F D X A X, 


G A X F F 


G 7 D 7 D 


,D D A G D 


_G,G D A A 




4 

G G F D D 


D 7 F F 7 


7.A G 7 A. 

— 5 — 

A F G A X 


X A A G G 


5 

X G X D D 


D A D X F 




A.DFFG 


D, G F D A 
G A 7 A D 


F F D 7 D 


D.DAGA 

8 

D G G X A 


F A D A 7 




7 

D D D A 7 


F.GDDF 

9 

G F D A G 


F D G D 7 


X A X D A 




D ,X D 7 F 


F.X 7 A X 
A G A 7 D 


X F F F F 


A .A X D A 


_F,7 D X G 




10 

X F D A G 


7 .A G A F 


E G,D A 7 
D A G D G 


11 

V D D D D 


D F X G 7 




.A F F A A 


_F,F F D 7 


' 12“ 

D F F A F 


G.A A A F 


_D,XA X A 




13 

7 A X D A 


G A D X D 


7 F.A F F 


F G, D D A 


14 

D D D F A 


G D F A X 


a 






15 







D G 



FIGURE 51. 
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No. 3 No^ 6 




FIGURE 52. 



sequences represent an accidental identity; these A*s belong at the 
bottom of column 12 in each diagram, and the true identical sequences 
are F F A A F, and not A F F A A F. In some cases there may be many 

■ i 

more instances of such accidental identities before and after the true 

identical sequences. Another thing to be noted is that the identical 

\ 

beginnings in this case run along for at least 4 comploto rows and part 

i 

of the 5th row in the transposition rectangle. Therefore, the identical 

i 

sequences should consist of not less than 4» and not more than 5 letters; 
any letters m excess of 5 in any identical sequence are accidental 
identities. There are several such accidental identities in the case 
under study, viz, m columns 5 and 12. 

c. Now comes the attempt to place the columns in proper sequence 

in the respective transposition rectangles. Since No. 6 has only 2 long 

/ 

columns, viz , 5 and 12, it is obvious that thooo two columns belong at 
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the extreme left of the rectangle. Their order may be $-12 or 12-5; 
there is no way of telling which is correct just yet. Since No. 3 has 
5 long columns, viz, 3,4,5,7,12, and since from No. 6 it has been as- 
certained that 5 and 12 go to the extreme left, it is obvious that 
columns 3» 4, and 7 occupy the 3&, 4th, and 5th positions in the 
rectangles. Their order may be any permutation of the three numbers 
3, 4» and 7; their exact order must be ascertained by further study. 

d. In this study to fix the exact order of the columns and thus to 
reconstruct the transposition key, advantage can be taken of the diverse 
lengths of other cryptograms that may be available in the same key. In 
this case there are 6 additional cryptograms, Nos. 1, 2, 4, 5, 7, and 
8, suitable for the purpose. The following calculations are made: 




Now No. 7 has 4 long columns, and these must consist of four columns 
from among the five already ascertained as falling at the extreme left, 
viz, 3i 4» 5, 7» and 14. Columns 5 and 14 have furthermore been placed 
in positions 1, 2, leaving columns 3* 4, and 7 for positions 3, 4, and 
5> Which of these three possibilities is to be omitted as a long column 
in No. 7? A means of answering this question involves certain considera- 
tions of general importance m the cryptanalysis of this typo of system, 
e. Consider a transposition rectangle in which the number of 
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columns Is even, and consider specifically the 1st pair of columns in 
such a rectangle. The combinations of bipartite components formed by 
the juxtaposition of these 2 columns correspond to plain-text letters, 
and therefore the distribution of the bipartite digraphs in these 
columns will be monoalphabetic in character. The same is true with 

• j- , 

respect to the bipartite components in the 3d and 4th columns, the 5th 
and 6th columns, and so on. Hence, if a long cryptogram ,of this nature 
is at hand, and if the two columns which belong at the extreme left 
can be ''ascertained, then a distribution of the bipartite digraphs formed 
by juxtaposing these columns should not only be monoalphabetic, but 
also this distribution, if it is at all normal, will afford a basis for 
matching other columns which will produce similar distributions, for the 
text as a whole is monoalphabetic. In this way, by proper matching of 
columns, those which really go together to form the pairs containing the 

— j 

bipartite equivalents of the plain-text letters can be ascertained. 

From that point on, the solution of the problem is practically the same 
as that of solving a columnar transposition cipher with non-fractionatod 
letters. 

f. But now consider a plain-text rectangle in the ADFGVX system, 
in which the number of columns is odd, and consider specifically the 
1st pair of columns in the rectangle. Now only the alternate combina- 
tions of bipartite components in these columns foxm the units of plain- 
text letters. The some is true of the bipartite components of the 3d 
and 4th, the 5th and 6th columns, and so on. In all other respects, 
however, the remarks contained in subparagraph £ apply equally to this 

case where the width of the rectangle is odd. 

\ 
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£. Returning to the problem under study, it has been ascertained 
that columns 5 and 14 fall at the extreme left. Whether their correct 
order is 5“14 or 14“5 cannot at the moment be ascertained, nor is it 
essential. The thing to do is to make a distribution of the bipartite 
pairs and see what it 'is like. Since the width of the rectangle here 
is odd, only the 1 st, 3 d, 5 th, ... pairs down the columns can be dis- 
tributed in a frequency square. The results are shown in Fig. 53* 



1 

3 

5 

7 

9 

11 

13 

15 

17 

19 



noted, 3 of FD. These must represent high-frequency letters. The 

(j) test for monoalphabeticity may be applied. 

I ($p) = .0667 x 21 x 20 : 28.01 

E (0 ) = .0385 x 21 x 20 : 16.17 
r 

♦ = (5 x 4 ) -f- (2 x 1) -y (2 x 1} -1- (3 x 2) + (2 x 1) 4* (2 x 1) : 34 
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No. 3 



No. 6 



Col. 

JL 

D 
D 
A 
0 
D 
0 
X 
A 
V 
G 
D 
G 
A 
D 
A 
F 
A 
X 
F 
A 



Col. 

A 

A 

A 

F 

D 

A 

D 

A 

D 

X 

V 

V 
A 
X 
F 

V 
A 
D 
D 
G 



3 

5 

7 

9 

11 

13 

15 

17 

19 

21 



Col. 

D 

D 

A 

G 

D 

G 

G 

D 

A 

A 

G 

G 

F 

D 

D 

D 

V 
F 
F 

V 

V 



Col. 

A 

A 

A 

F 

D 

X 

A 

X 

A 

V 
A 
X 
D 

‘ A 
G 
A 
D 
X 
D 

V 
F 



1st 



2d 



A D F G V X 



TfH 




1 








II 


II 




1 


1 






III 










It 














II 


1 










1 











FIGURE 53 . 

h. The distribution is fairly good. Five occurrences of AA are 
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The observed value of |> is considerably greater than the expected value 
for plain text and more than twice as much as the expected value for 
random text. Using the distribution in Fig. 53 as a basis, an attempt 
is made to add to the 5"14 combination a column selected from among ' 
columns 3, 4» and 7* so that the 2d, 4th, 6th ... pairs down t r he 2d and 
3d columns in the rectangle will give bipartite pairs that will confoim 
to the distribution noted in Fig. 53* Since the results sought will be 
very materially affected if the combination 5*14 should really be 14~5» 
all possible combinations of 5~14 and 14" 5 with 3» 4». and 7 must be 
tried. The various combinations tested oro shown in Fig. 54 • 

i,. Frequency distributions are now made. If combination 5~14"3 is 
correct for No. 3, i-t xs also correct for No. 6; hence, a single dis- 
tribution is made of the bipartite'"pairs in lines 1, 3i 5» of columns 

5"14*~and of the pairs in lines 2, 4, 6, ... of columns 14-3* Similar 

distributions are made of the pairs given under eacn of the other com- 
binations. These distributions are shown in Fig. 55 • 

J_. These distributions are now tested for monpalphabeticity, by 
applying the <|> test. The number of occurences /in each distribution is 
41. Than 41 x 40 x .0667 = 109*4 is the expected value of (j) for plain 
text; 41 x 40 x .0385 r 63*1 is the expected value of <j. for random text. 
Here are the calculations for the first distribution ( combination 5— 14“ 3) 
yielding the observed value of <j> as 76: 

{5x4)+(lxO)+(ljO)+(lxO) + (2xl) f(2xl) + 

(2 X 1) t {3 1 2) -Ml x 0) + |1 x 0) + (5 1 4) t (2 x 1) + 

(1 x 0) + (3 x 2) + (3 x 2) + (1 x 0) + (2 x 1) + (3 x 2) + 

(2x1 )- 76. 

The observed values for all 6 frequency distributions are shown herewith: 

(1) 76 (3) .88 (5) 70 (2) 76 (4) 108 (6) 110 



- 132 - 



REF ID : A56913 



No. 3 . * 





(1) 


{2} 


(3) 


(4) 


(5) 


(6) 




5-34-3 


51-34-4 


IzM 


1.4 -±1 


14-5-4 


14-S7.2 


1 


DAD 


D A F 


DAD - 


ADD 


A D F 


ADD 


2 


DAY 


■ Dad 


D A F 


A D V 


ADD ' - 


A D F 


3 


A A F 


A A X 


A A F 


A A F 


A A X 


A A F 


4' . 


G F D 


, G F A 


G F G 


F G D 


F G A 


F G G 


5 


DDF 


D D X 


D D D 


DDF 


D D X 


D D D 


6 


G A X 


G A V 


G A X 


A G X 


A G Y 


A G X 


7 


X D A 


X D A 


X D D 


D X A 


D X A 


D X D 


8 


A A G 


A A D 


AAV 


A A G 


A A D 


AAV 


9 


V D F 


V D X 


V D D 


D V F 


D V X 


DVD 


10 


G X X 


G X F 


G X A 


X G X 


X G F 


X G A 


11 


D Y A 


D V X 


DVD 


V D A 


Y D X 


V D D 


12 


G Y F 


G V F 


G V A 


V G F 


V G F 


VGA 


13 


AAA 


A A D 


A A Y 


AAA 


A A D 


AAV 


14 


D X F 


D X G 


D X D 


X D F 


X D G 


X D D 


15 


A F A 


A F A 


A F A 


F A A 


F A A 


F A A 


16 


F Y X 


F V G 


F V D 


V F X 


V F G 


V F D 


17 


A A D 


A A F 


A A D 


A A D 


A A F 


A A D 


18 


X D D 


X D G 


X D D 


D X D 


D X G 


D X D 


19 


FDD 


F D G 


F D G 


D F D 


D F G 


D F G 


20 


A G D 


A G A 


A G A 


GAD 


G A A 


G A A 








No. 


6. 








(1) 


(2) 


(3) 


(4) 


(5) 


(6) 






5-34*4 


fcjfcZ 


14-5-3 


14-A-4 




1 


DAD 


D A F 


DAD 


ADD 


A D F 


ADD 


2 


D A V 


DAD 


D A F 


A D V 


ADD 


A D F 


3 


A A F 


A A X 


A A F 


A A F 


A A X 


A A F 


4 


G F D 


G F A 


G F G 


F G D 


F G A 


F G G 


5 


DDF 


D D X 


D D D 


DDF 


D D X 


D D D 


6 


G X D 


G X G 


G X G 


X G D 


X G G 


X G G 


7 


G A F 


G A A 


G A F 


A F G 


A G A 


A G F 


8 


D X F 


D X X 


D X D 


X D F 


X D X 


X D D 


9 


A A F 


A A F 


AAA 


A A F 


A A F 


AAA 


10 


A Y D 


A Y F 


A V A 


V A D 


Y A F 


Y A A 


11 


GAD 


G A V 


G A F 


A G D 


A G V 


A G F 


12 


G X F 


G X D 


G X G 


X G F 


X G D 


X G G 


13 


FDD 


F D Y 


FDA 


D F D 


D F Y 


D F A 


14 


DAD 


D A A 


D A X 


ADD 


ADA 


A D X 


15 


D G F 


D G F 


D G F 


G D F 


G D F 


G D F 


16 


D A X 


DAG 


D A F 


A D X 


A D G 


A D F 


17 


Y D Y 


Y D V 


V D D 


D V F 


D V Y 


DVD 


18 


F X X 


F X D 


F X V 


X F V 


X F D 


X F V 


19 


F D X 


F D Y 


FDD 


D F X 


D F V 


D F D 


20 


Y Y F 


Y Y D 


V V D 


V V F 


V V D 


V Y D 


21 


Y F D 


V F 


V F 


F V 


F V 


F V 



FIGURE 54. 
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(1) [5-14-3 




■ 




(2) £-14-4 


3 




it 


(3) 


(5-14-3 


3 


1 




A 


D 


F 


G 


V 


X 




A 


D 


F 


G 


V 


X 




A 


D 


F 


G 


V 


X 


A 


£ 


D 


n 


D 


Hi 


II 


D 




Ml 


• 


D 


1 




n 


IS 




1114 


■ 


a 


n_ 


D 


n 


HI 




1 


/ 




19 




a 


■ 


if 


1 




H 


II 


III 




1 


/ 




F 


■ 


■ 


1 


■ 


■ 


■ 


F 


IJ 


in 


■ 


■ 


■ 




F 




III 




If 






G 


ii 


D 


1 


■ 


■ 


■ 


G 


i 


1 


■ 


■ 


■ 




G 


III 


■ 


■ 


B 






V 




in 


HI 


■ 


■ 


1 


n 


■ 


hi 


III 


l 






n 




lilt 


1 


■ 






X 


g 


11 


in 


■ 


■ 


II 


M 


■ 


in 


1 


11 




/ 


H 




III 




id 


t 






I 












(5) (14-5-4) 








(6) ^4-5- 


a 


1 






B 






9 






A 


D 


F 


G 


V 


X 




A 


D 


F 


G 


V 


X 


A 


to* 


B 


■ 


m 


■ 




n 


K 


III 


D 


II 


■ 


■ 


D 




■ 


■ 


II 


B 


■ 


D 


■ 


a 


0 








11 


1 


HI/ 


to 


II 






19 






1*1 

1 




11 


II 


F 


r 


■ 


■ 








F 


1 


D 




1 


n 


■ 


F 


I 


/ 


■ 


■1 


II 




G 




uu 


II 




■ 


II 


G 


11 


n 








■ 


m 




1 


J 


J 


■ 


B 


V 




1 


1 






■ 


V 




11 








■ 


H 




11 


■ 


■ 


■ 


■ 


X 


■ 


D 


■ 






■ 


X 


I 


■ 






■ 


■ 


X 




1 


■ 


■ 




■ 



FIGURE 55. 

Only two of these distributions give close approximations to 109, the 
expected value of and they may be retained for further experiment. 

i 

They are the ones for combinations (4) and (6), with values of 108 and 
110, respectively. 

k. Selecting combinations (4) and (6) viz, 14-5*3, and 14-5-7, 
since columns 14, 3» 4, 5 and 7 form the r group of 5 columns at the left 
of the transposition rectangle, the following combinations are possible: 

1) 14-5-3-4-7 ” (3) 14-5-7-3-4 

2) 14-5-3-7-4 (4)' 14-5-7-4-3 *. 

l. The following sets of columns correspond to these 4 combinations 

t 

in the 2 cryptograms (Fig. 56) . 

m 
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No. 3. 





(1) 


(2) 


(3) 


(4) 




14-5-3-4-7 


1 i'JrJr.tA 




14-5-7-4-3 


1 


ADDFD 


A D D D F 


A D D D F 


ADDFD 


2 


A D V D F 


ADVFD 


A D F V D 


A D F D V 


3 


A A F X F 


A A F F X 


A A F F X 


A A F X F 


4 


F G D A G 


F G D G A 


F G G D A 
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m. The additional bipartite pairs given by adding columns 4" 7 to 
the basic combination 14-5-3“ are distributed in the 4th frequency dis- 
tribution square of Jig. 55, yielding the distribution shovm in square 
(1) of Fig. 57. The other squares in Fig. 57 are constructed in the same 
way, for the other combinations of Fig. 56. 
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(1) For combination 14-5-3-4-7, I 390 

(2) For combination 14-5“3“7"4» <j> - 270 

(3) For combination 14 _ 5 _ 7"3 _ 4> $ : 326 

(4) For combination 14 - 5“7"4“3> <j> z 342 

The combination l4-5“3"4“7i giving the greatest value for <j>, is very 
probably the correct one. 

o. Examining the other cryptograms that are available, it is seen 
that No. 7 is the third longest one of the entire set, with 124 letters; 
moreover, the dimensions of the rectangle JJ 15 x 9) - 11 z 124J are such 
as to bring about 4 long columns of 9 letters and 11 columns of 8 letters. 
The first 5 columns are definitely fixed in' position, since it is known 
that the first 5 key numbers are 14”5"3"4“7- The resulting diagram is 
shown in Fig. 58. There is now a section consisting of 10 columns which 
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FIGURE 58. 



are to be anagrammed to ascertain 
their correct sequence. The column 
to follow column 7 is ascertained 
on the basis of the repetitions 
which are brought about when the 
selected column is placed on the 



right. These repetitions should 

fall into those cells of frequency distribution (1), Fig. 57 » which are 
of high frequency. In other words, the process is one of selecting from 
among columns 1, 2, 6, 8, 9, 10, 11, 12, 13, and 15 that column which 
will yield the most repetitions of bipartite digraphs with the digraphs 
given by the juxtaposition of columns 14”5“3"4"7* as distributed in 
frequency square (1) of Fig. 57- The column thus selected turns out to 
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be number 10. Then other columns are added by proceeding along the same 

/ 

lines • the work becoming progressively more easy as the number of avail- 
able candidates decreases. Sometimes the discovery of what appears to 
be a long repetition within one of the cryptograms or between two crypto 
grams facilitates the process. In this case the results obtained from 
the 3 cryptograms under study are shown in Fig. 59 • 
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Figure 59 " Continued. 
No. 6. 
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£. What the cryptanalyst now has before him is a monoalphabetic 
substitution cipher, the solution of which presents no difficulties. The 
cipher square is reconstructed as completely as possible, blanks being 
left where there are no occurrences to give clues as to the character 
involved, usually some of the digits and the very infrequent letters. 

In this case the only letters which do not occur in the plain text are 
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Q, X, and Z. The digits 5 and 7 are recovered from the context, in 
message number 6, where the caliber of a gun is mentioned and the 
digits are confirmed at other places ih the message. The square that 
is obtained is seen in Fig. 60. Examination of the mixed sequence dis- 
closes that it is based upon the phrase THE FLOWERS THAT BLOOM IN THE 
SPRING. This permits of the establishment of the transposition key and 
of the position of the digits in the checkerboard (as in Par. 3#i) • 

The results are shown in Fig. 61. The completely solved messages are 
shown in Fig. 62. 
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• No. 2. 
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Figure 62 - Continued. 
No. 3. 
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Figure 62 - Continued. 
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Figure 62 - Continued. 
No. 6. 
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Figure 62 - Continued. 
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40. Special solution by the exact factor method. - a.. The student 
who has comprehended the successive steps in the solution of the example 
discussed in the preceding paragraph is in a position to grasp at once 
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the mechanics of the special solution by the exact factor method. The 
latter is based upon the interception, of a number of cryptograms, pref- 
erably lengthy ones, which have been enciphered by rectangles in which 
the last row is completely filled with letters. The total number of 
bipartite components in the case of such a cryptogram will yield clues 
as to the dimensions of the transposition rectangle. Then the text is 
transcribed into columns of appropriate length, all being equal in this 
respect, and the process of combining columns, as explained in Par. 39£» 
is applied in order to produce the besb monoalphabetic distribution of 
bipartite digraphs down the Juxtaposed columns. There is nothing to 
prevent the simultaneous use of all cryptograms that have been enciphered 
by completely-filled rectangles, for it is clear that if, for example, 
columns 15 and 4 are to be paired in one cryptogram, the same columns 

will be paired in oil the other cryptograms. Eonce, even if the 

* 

rectangles are small in depth they can be used in this process; it is 
necessary only that all columns of any rectangle be of the same length. 
Now if only two or three such pairs of columns can be set up correctly, 
solution follows almost as a matter of course. No additional or new 
principles need be brought into play, beyond those already possessed by 
the student. 

b. In this special solution, the important step is, of course, the 
initial one of experimenting with roctangles of various dimensions until 
the correct size has beon hit upon. In some .cases, excessive expert- 

i 

mentation may not be necessary if the total number of characters is such 
as to yield only one or two possibilities with regard to the length of 
the columns. For example, suppose that previous work has established 
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the fact that the enemy uses transposition rectangles not less than 15 
and not more than 22 columns in width. A message totaling 7°3 letters 
would indicate a rectangle of 19 columns of 37 letters, since these two 
numbers are the only factors of 7^3* If this then were corroborated by 
other cryptograms of 76 (19 x 4), 152 (19 x 8), 190 (19 x 1°) letters, 
the probability that 19 ia the width of the transposition rectangle 
becomes quite persuasive. Of course, there will be and there should be 
other cryptograms of lengths that do not factor exactly; these represent 
the ones in which the rectangles are not completely filled in their 
last row. They do not enter into the solution at first, but just as 
soon as the positions of two or throe key numbers became fixed, the 
data afforded by these messages become available for use in the later 
stages in the solution. 

c. The exact-factor method is a useful one to know. For despite 
all instructions that may be drawn up insisting upon the advisability 
of not completing the last row of a transposition rectangle, the 
tendency to violate such a rule is quite marked, especially where a 
large cryptographic porsonnel must bo employed. It is not astonishing 
to find that the temptation to fill the rectangle completely is particular- 
ly hard for lazy or ignorant clerks to resist when it happens that a 
message falls just one, two, or three letters short of forming a completely- 
filled rectangle: it is so much easier for such clerks to handle a rec- 
tangle with equal-length columns than one m which this is not the case. 
Moreover, the number of errors and therefore the number of times a 
shiftless or careless clerk must go over his work to correct errors is 
reduced to a minimum. Hence, it often happens that in such cases an 
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enciphering clerk adds one, two, or three letters to complete the last 

. i 

row, thus leading to the transmission of not a few .cryptograms enciphered 

by completely-filled rectangles. - 

. d. Space forbids giving an example of such a solution. For 

students who desire to exercise their skill' in executing the procedure, 

there is given in Appendix 2 a set of 44 cryptograms which were actually 

solved by this method. The text is in German, but a knowledge of the 

language is not essential to the reconstruction .of the transposition 

key and of the various transposition rectangles involved. , 

41* General solution for the ADFGfVX system. - a. All three of tie 

foregoing methods of solving cryptograms in the ADFCJVX system fall in 

the category of special solutions and therefore are dependent upon the 

fortuitous existence of the special conditions required under each case. 

What is really desired in the practical situation is a method of solution 

which is not so dependent upon chance or good fortune for success. A 

search for a, general solution was, of course, made during the time that 

the system was under minute study by. the cryptanalytic agencies of the 

Allies, but -no general solution was devised. All the solutions made 

during actual hostilities nwd for a number of weeks thereafter were of 

the special types described in the .preceding paragraphs. The first , 

published description of a general solution is, to be found in Givierge* s 

Cqut 8 de Cryptographle, I925, but only m broad outlines. A complete 

general solution was independently conceived by a group of cryptanalysts 

in the office of- 1 the Chief Signal Officer^. -and will be described in 
Paragraphs 42 and 43. 



See footnote 5 below. 
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b. The attention of the student is directed to the comments made 
in Paragraph 18 , -with regard to the significance of the term general 
solution in cryptanalysis. He must be cautioned not to expect that in 
practical work a general solution will, in the cryptanalytic as in the 
mathematical field, invariably lead to a solution. If there is a suf- 
ficient amount of text and if the text contains no abnormalities, the 
attempt to apply the general solution will usually be successful. But 
the cryptanalyst must remember that the ADFGVX system is by no means a 
simple one to solve even under the best of conditions and if there is 
only a small amount of , text, If it happens that the transposition key 
is unusually long, or if the text is abnormal, he may not succeed in 
solving the messages by the straightforward method to be set forth below, 
and he may have to introduce special modifications. For the latter he 
can only rely upon his own ingenuity and intuition. 

42. Basic principles of the general solution. - a. Every trans- 
position rectangle m the ADFGVX system must conform to one or the 
other of two and only two fundamental types: the number of columns must 
be either odd or even. A number of important consequences follow from 
this simple fact, some of which have already been pointed out in Para- 
graph 39 «j. They will bo elaborated upon in the next subparagraphs. 

b. Consider a rectangle with an even number of columns. Each 
of its rows contains on even number of bipartite components, half of 
which are initial components, half, final components, alternating in a 
regular order from left to right in tho rows. When the transposition is 
applied, all the components within a given column aro of the same class, 
either initial or final. No intermixture or alternation of the two 
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classes is 'possible. On the other hand,' consider' a rectangle with an 
odd number of columns. Bach of its rows contains an odd number of 
bipartite components, the 1st row cont aiding- one more; initial component, 
than final components, the 2d row containing one -more final 'component 
than initial components, and'so on, 'this -arrangement alternating 

regularly in the successive rows of tie rectangle.. When one- studies 

\ 

the various columns of the' rectangle , it is seen that in each column 
there is a' perfectly regular alternation of initial and final components, 
the odd columns (1st, 3d, 5th, ...) beginning with an initial component, 
the even columns (2d, 4th, 6th, ...} beginning with a final component. 
This alternation in components remains true even after the transposition 
is applied. These remarks bocome very clear if one studies Big. 63.* 

Two transposition rectangles are shown,' one with an even number of - 
columns, the other with an' odd number. Instead of the actual components 
(ABFGVX) , the symbols 6^and 0 2 are used to indicate the two classes of 

i 

components, initial and final, because in this analysis interest centers 
not upon the actual Identity of a component but upon. the class to which 
it belongs, initial or final. At the top of each .column is. placed a 
"plus" to denote a column occupying an odd-numbered position in the 
rectangle, or a "minus" 'to denote a column- occupying an even-numbered 
position. 

Even no. of columns ' Odd no. of columns - 



±-Z ±_=. 



6 1 0 2 



0 1 ®2 



e l 0 2 



e l 0 2 



+ - - i r - ■ 



e l e 2 



9 1 0 2 



®1 ®2 ®1 0 2 



9 1 ?2 



®1 02 01 ®2 ®1 02 ®1 02 01 02 



9 1 % 2 






9 1 0 2 



9 1 ®2 



H- - 



9 1 9 2 



0i 0c 



_ _ _ 1 "2 -' e l 0 2 °1 

02 01 02 ’ 01 ®2 '-'- 01 02 01 02 

0i 



®i e 2 



®1 ®2 



®1 ®2 



-±. 



9i 



1TGURE 63. 
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£. In what follows, the term "odd column" will mean merely that the 
column in question occupies an odd position (1st, 3d, 5th, ...} in the 
transposition rectangle; the tern "even column", that it occupies an even 
position (2d, 4th, 6th, ...) in the rectangle. The odd or even desig- 
nation has no reference whatever to the nature of the transposition key 
number applicable to that column, whether it is odd or even. Now when the 
transposition is applied to the even-width rectangle a., Fig. 63 , the 
cryptographic text will consist of a number of sections of letters, each 
section corresponding to a column of the rectangle, and therefore the 
number of sections in this case will be even. Moroover, all the com- 
ponents in a section corresponding to an odd column in rectangle a will 
be initial components, all those in a section corresponding to an even 
column, final components. The sections or columns are completely 
homogeneous with respect to the class to which their constituent com- 
ponents belong. On the other hand, when the transposition is applied 
to odd-width rectangle b, the cryptographic text will consist of an odd 
number of sections, each corresponding to a column of the rectangle. 

The components in the sections consist of members of both classes of 
components in a regular alternation; in a section corresponding to an 
odd column the order is © 2 -^ ®1 •••» a section corresponding to an 

even column the order is 9]_r? ©3 • • ■ • The sections or columns 

are not homogeneous in this case as they are in the former. 

d. Now if there were some way of distinguishing between initial 
components as a class and final components as a class it is clear that it 
may be possible first of all to ascertain whether the transposition rec- 
tangle contains an even or an odd number of columns. Secondly it may be 
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possible to identify those columns which are even and those which are 
odd. Finally, it, may be possible to ascertain which arc the long columns 
and which are short , thus yielding the exact outlines -of the rectangle 
in case the last row is Incompletely filled. From that point oh, solu- 
tion follows along the same lines as explained in paragraph 40 » with the 
modification that in the pairing of columns the number of po&sibilitios 
is greatly reduced, 3ince it is useless to pair two columns both con- 
taining initial components or final components. 

• e. The foregoing depends then upon the possibility of being able 

i 

to distinguish as a class between initial and final components of the 
bipartite cipher equivalents in this systom, or at least between letters 

t 

belonging to one or the other of these two general classes of components. 

i 

Now if the substitution checkerboard has not been consciously manipulated 
with a view to destroying certain properties normally characterizing its 
rows and columns, the sort of differentiation indicated .above is quite 
possible. For example, if in the checkerboard shown in Fig. 6l the 
normal frequencies of the letters "as they appear in English telegraphic 
plain text^ are insortod in the cells end totals are obtained vertically 

and horizontally, theso totals will permit of assigning frequency weights 

\ 

to the letters ADFGVX as initial and. as final letters of tho bipartite 

a 

cipher equivalents of the plain-text letters. This is shorn below in 
Fig. 64* The bipartite letter A has a frequency value of 284 as an 
initial component of tho bipartite cipher equivalents of plain-text 

i 

letters, and a frequency value of only 169 as a final component. 

As given in Fig. 3> page 13, Military Cryptanalysis, Part I . 
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A 
D 
F 
G 

N 

V 
X 

, Sums 

Similarly, the letters V and X have frequency values of 47 and 69 > 
respectively, as initial components and 120 and 198 as final components. 

It i3 ohvibus , then, that in this checkerboard the weighted frequency 
values of the lettors A, V, and X as initial components differ consider- 
ably from the values of these same letters as final components, the value 
for G as an initial is only a little less than its value as a final, the 
values of D and F as initials are only a little more than their values as 
finals. But it is the '.vide variations in the weighted frequency values 

1 

of certain of the letters as initial components and as final components, 
exemplified m the case of A, V, and X, which foxm the basis of tho 
general solution, because those wide variations afford a means for making 
the various differentiations noted in subparagraph d. 

f. Of course, in working with an unknown example, the composition 
of the checkerboard is unknown and therefore no accurate frequency 
weights may be assigned to tho ADFGVX components in the cryptograms. How- 
ever, it is still possible to arrive at some approximations for these 
weights in case there are several cryptograms available for study, as would 
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normally lie true in actual practice. -How this >. can be done will be shown 
very soon, by studying an example.- For the purposes of this study the 



set of 12 cryptograms given below will be used. , 

I 



7 D D G G 

V D X F D 
D G D G V 
D A D A D 

V D D G V 
F V G F V 
F D D X A 
A F F V F 
D D G D V 



G V F D F 
D X D 7 X' 
G D D D F 
F X A V F 
D D D D A 
DGADV 
D F G D A 
A F X G F 
X A X F D 



V D V V F' 
A D 7 D 7 
X F A D A 

V D D A A 

V A D A F 
F X V X D 
G X D-D A 
X D G V A 



7 D G A D 
F X G U F 
7 D 7 G D 
V D F F D 
A D D X A 
G D D A G 
7 F D A F 
D F V D G 



D X (212 letters) 



D A F F F 
V A D D G 
G A D X V 
F V G D F 
D D G A D 
G D D X F 
G V F V F 
G A V G G 



' II 



7 D A A 7 

V A G D D 
F V A X V 

V F G D F 
A A A X D 



DDFXF XDDAX 
F A X D 7 AVDVD 
XAVGD VDXFD 
VDXAV XDDVG 
D X G (108 letters) 



GXFXD DFXAD 
DFVFV FFGDG 
XDGAX GFGGF 
DDVGV AGFXF 



D A G A A 
F X F D X 

V G D G X 
X A G G D 

V F D A X 
F 7 D F D 
E X A A D 
D X F G G 



F G A G V 
D D A G A 
D D D A V 
D A 7 G V 
G D D D G 
X F 7 G D 
F A D G G 
DDXGD 



III 

D A F_G G 
D D G 7 A 
F 7 D D F 
F G D 7 F 
D A F D A 
D 7 A 7 F 
7 F D A 7 
A 



X F D X D 
D D 7 D D 
D A A A A 
7 D G ;G X 
D G G A D 
D D D 7 F 
D G X F 7 



F 7 7 X G 
G 'A F G A 
D X A G D 
G G A F F 
D G D X A 
A G D F F 
D A A 7 G 



(186 letters) 



17 



ADT7F X7GG7 
DDGDG FD77A 
DAXDD DAG7F 
DDDAD 7 X 7 F A 
7D7DD A X D A A 



FDD7A F G A A 7 
FGXFX FDDDD 
F A A D 7 G D F X G' 
7 D A_X X DFAAF 
(110' letters) 



F D G 7 D 
7 G D A X 
X G 7 G D 
A 7 D 7 G 

i 
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V 



D F X F D 


D V V V D 


X F X F X 


F F F Y A 


G F 3 X A 


VDAGI 


3 V 3 G F 


A D A A D 


F 3 V F G 


3 A 3 F V 


FVFXG 


X D D A G 


D V G V F 


3 G X X 3 


F F G 3 G 


X G V 3 3 


Y D D F G 


F7GDD 


V F V A G 


X X 3 F V 


3 X A V F 


G A G A G 


A X D Y D 


F X G V G 


3 A 3 3 X 


A G X 3 A 


D F D G X 


F 3 G G F 


Y G X V V 


G 3 3 3 A 


G X V D G 


Y D V G X 


3 3 F 3 3 


V A G A A 


D G 3 3 F 


D G A G D 


F 3 3 3 D 


X G V G V 


G G G 3 G 


X 3 F G F 


A D (202 letters) 














VI 








G D G F X 


A G V F V 


D D X G X 


3 V 3 3 A 


X 3 A A X 


F A G V G 


D X F F V 


X F A D G 


F F 


3 X A 


A F V X F 


D F X F V 


G D G F X 


F D V V X 


V G 3 F V 


3 3 V F 3 


F V V D V 


D G G Y F 


X F G V X 


F F Y G V 


3 3 G 3 3 


'DDGDD 


A V G V X 


G A F F X 


F V'3 3 D 


(120 letters) 






VII 








G A F G F 


F X F V F 


G F X A V 


A G G X 3 


X X 3 3 F 


A G V D D 


Y D Y F F 


A D A V A 


V F 


V G G 


A 3 A A F 


V F 3 F V 


3 X F X X 


G D X D n 


F Y 


3 F F 


X 3 V F X 


V A D X V 


A X 3 V X 


A F F V 3 


F 3 


G X F 


3 G F 3 3 


F V D V V 


A A F V F 


F V X 3 G 


F D 


3 V A 


3 3 F 3 3 


D X F F A 


G F X F X 


A A G V D 


G G 


V 3 F 


G G G X 3 


F 3 F V A 


F F G F X 


G D A X D 


G 3 


G G 3 


3 A V 3 X 


A D F A F 


V F X 3 3 


X Y A G D 


V V 


3 3 F 


X 3 G X X 


D V F V F 


3 3 3 3 A 


A F 3 F X 


3 X 


G 3 A 


A F V 3 F 


3 V 3 3 V 


A 3 3 V 3 


Y A V D G 


A F 


Y F X 


F A A Y 3 


D F V D (254 letters) 












VIII 

l 








i 

D G V V G 


F X 0 G G 


A D F A F 


V V 


VAX 


A Y G G V 


7DYGV 


V 3 A V G 


3 G 3 G A 


Y F 


3 3 A 


3 3 3 X X 


3 X F V F 


X G V G G 


3 G D F G 


G 3 


ABF 


3 3 X A V 


F D D V F 


A 3 X G 3 


A 3 G Y A 


F F 


X A 3 


F A 3 X 3 


gfadf' 


3 3 G V 3 


V X A V A 


3 3 


X F F 


A G 3 X F 


F V F G F 


GFDFD 


V 3 X X 3 


3 G 


G 3 (144 letters) 


S 




IX 








G D D D D 


XY0Y11 


Y 3 A Y G 


F G 


BFV‘ 


3 V A V 3 


G F A G X 


A V F F G 


Y A 3 3 3 


A X X' A X 


'3 G A 3 G 


XAVVD 


G X X A A 


A V A 3 A 


3 G X 3 V 


G 3. 3 3 3 


G Y F X A 


A V G G Y 


F X 3 A F 


3 G V G A 


F G 3 3 F 


A V Y G D 


3 V 3 F X 


3 V 3 G F 


V A A G 3 


X F 3 Y A 


A 3 A G D 


A X F Y G 


3 3 3 A G 


V A V F G 


X X F 3 3 


G X F Y 3 


G G D A Y 


3 A G G F 


3 A X 3 X 


F F V G F 



A X X A D D F (182 letters) 

i* 
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1 

X 
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V F 


A 7 D 


7 F D A 


D 


G 


F 


7 G 
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D 


D 7 


G X g y 
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7 G 


D 


X 


D 


G 


D 
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F 
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F 


D 


X 


7 D 


A A D 


D F X D 


D 


A 


F 


F A 


A 


F 


7 


F 


A 


G 


D 


A 


A 


G 


G 


F A 


X G V 


X X F X 


A 


D 


G 


D F 


D 


G 


X 


G 


D 


A 


D 


A 


X 


G 


V 


V V 


D A A 


G G 7 F 


G 


7 


A 


7 F 


7 


A 


A 


G 


A 


X 


G 


X 


D 


G 


A 


(130 letters) 








































XI 






















7 


F 


D 


D 


7 


A X 


G 


D 


A 


D F G G 


G 


G 


F 


G D 


D 


F 


X 


X 


D 


A 


F 


D 


D 


X 


G 


G A 


V 


G 


A 


G D 7 D 


F 


D 


F 


D D 


D 


G 


A 


F 


A 


F 


D 


A 


A 


A 


G 


V A 


V 


F 


G 


G 7 A D 


D 


G 


D 


D F 


G 


F 


7 


D 


D 


A 


D 


F 


G 


A 


F 


D F 


7 


D 


D 


F 7 V 7 


A 


D 


A 


G D 


X 


F 


X 


X 


X 


F 


F 


D 


X 


G 


D 


F D 


G 


F 


D 


DFGD 


A 


G 


F 


A A 


G 


G 


A 


D 


X 


D 


G 


V 


D 


G 


A 


V G 


7 


D 


F 


D D F X 


G 


A 


G 


X F 


G 


7 


F 


7 


7 


D 


G 


V 


D 


X 


D 


F F 


F 


X 


G 


X G X A 


G 


A 


G 


7 G 


D 


7 


7 


X 


G 


F 


7 


D 


X 


D 


D 


X F 


7 


D' 


D 


X (136 


letters) 
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43- 


Illustration of 


solution. 5 


- 


a. 


Since the 


initial letters 


all 12 cryptograms are in 


the same class, 


that is, 


either initial or 



final components, they may all be combined into a single distribution. 



Furthermore,, since it is certain that regardless of whother the trans- 
position rectangle has an odd or an even number of columns the 3d, 5th, 
... letters of the cryptograms are in the same class as the first letter. 



5 

This illustration uses the same cryptograms and follows quite closely 
along the lines employed in a technical paper of the Signal Intelligence 
Service entitled General Solution for the ADFG7X Cipher , prepared by 
Messrs. Rowlett, Kullback, and Sinkov, in 1934* 
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the 3<i, 5th, ... letters may be added to the distribution, so long as 
these odd letters come from the same section (column l). It is, how- 
ever, necessary to limit the number of letters taken from the beginning of 
any one cryptogram to a reasonable length of column, depending on the 
size of the cryptogram. Assuming it is known that the enemy is using 
transposition keys of not less than 15 nor more than 22 numbers, the 
latter could be taken as the maximum possible size. But to bo on the 
safe side it vn.ll be here assumod that a transposition rectangle of not 
more than 25 columns is being used. Hence, so far as concerns crypto- 
gram 1, which has 212 lettors, on the basis of a key of 25 numbers 
j( 25 x 9) - 13 = 212] there will be 12 columns of 9 ls-cters and 13 columns 
of 8 letters. Since there is no way of telling which are long and which 
are short columns, it vali be safor to work on the basis of columns of 
8 lettors. Therefore, the first 8 lettors of cryptogram I are to be 
taken. In the case of cryptogram II, with 108 letters, its first 4 
letters will be takon, and so on, through the 12 cryptograms, xhe number 
of letters to be taken in each case being governed by the length of 
the cryptogram. The sections token in the case of the 12 cryptograms 
arc shown in Fig. 65. 



Cryptogram 


Length 


Lettors taken 






Letters uaken 


I 


212 


VDDGGGVF 


VII 


254 


GAFGFEXFVF 


II 


108 


VMA 


VIII 


144 


DGWG 


III 


186 


DAGAAFG 


IX 


182 


GDDDDXF 


IV 


110 


ADXV 


X 


130 


DGDDF 


V 


202 


DFXFDDW 


XI 


186 


VFDDVAX 


VI 


120 


GDGF 


XII 


224 


XFDFXWDV 



FIGURE 65., 
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b. The odd and the even letters of these 12 sections are then 
distributed separately, the results being, shown in Figs. 66 and 67. A 
consideration of the mechanics of ‘this system leads to the expectation 
that if the transposition rectangle has an even number of columns the 
two distributions will be similar; if it has an odd number, they will be 



different . The similarity or difference between the two distributions 
is usually discernible, with as few as 20 or 25 letters. 

Odd (1st, 3^, •••) letters Even (2d, 4th, ...) letters 




jfluUHE 66. FIGURE 67. 

£. Letters V and X are of high frequency in the odd positions 
(Fig. 66) but of low frequency in the even positions, (Fig. 67) whereas 
the letter F- is of low frequency in the odd positions and of high 
frequency in the even positions. There can be no question that the two 
distributions are dissimilar, and the indications are clear that the 
transposition rectangle involves an odd number of columns. 

d. Now tho letters in Fig. 66 may be initial components, those in 
Fig. 67, final components, or the reverse may be the case. At the present 
stage of the study it is Impossible to ascertain which of these alter** 
native hypotheses is correct. However, this information is really, im- 
material at this stage. Suppose the letters in Fig. 66 are arbitrarily 
designated as class 1 components, those in Fig. 67 are class 2 components. 
Class 1 components (Fig. 66} are characterized by a predominance of V's- 
and X*s (over their frequencies in Fig. 67); class 2 components (Fig. 67) 
are characterized by a predominance of F’ s (over its frequency in Fig. 66.) 
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e. The two distributions in Figs. 66 and 67 apply to the letters 
which come from Column 1 of the transposition rectangles for the 12 
cryptograms under study. In this column, the V f s and X* s fall pre- 

1 

dominantly in the odd positions, the F*s fall predominantly in the even 
positions. Therefore, beginning with position 1, the components in this 
column show an alternation of the type Bg—* 9^- By referring to 

1 

- Fig. 63- it will become clear that if, class 1 components are initial 
components, then it must follow that column 1 occupies an odd position 
in the transposition rectangle;, but if class 1 components are final. com- 
ponents, then it must follow that column 1 occupies an even position 

- in the transposition rectangle. Which of these alternatives is true 
cannot be ascertained at the- moment. But the important point to be noted 
is that a definite reversal in the type of alternation of class 1 and 
class 2 components indicates the progress, in the transposition, from the 
end of one column to the beginning of the next column . That is, if it is 

1 

found that from the beginning of the cryptogram the alternation of com- 
ponent a is 0^ — > 02 — ?■ 0.^ «Tvd after a number of letters this alternation 
changes to 0]^ — > ©2, the point where this change occurs marks the 

ond of column 1 and the beginning .of the column 2. For the sake of 
brevity in reference, in the subsequent paragraphs the type of alter- 
nation 0i“- > 02 — ^ ©]_ will be designated as the type", and this type 
of alternation characterizes columns which fall in odd-numbered positions 
in the transposition rectangle. The other type, 0 ^— 9 0g will be 

v 

designated as tho "- type”, and this type of alternation characterizes 
columns which fall in even-numbered positions in the transposition 
rectangle. 
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f. With these principles in mind, let cryptograms III and XI, each 
containing 186 letters, be studied. They may be superimposed, since they 
have identical numbers of letters and therefore the columns end at exactly 



the same points in both cryptograms. 

L. * 3 Jt JT 6 7 8 <1 io II IX 13 11 IS Jb 17 18 /<? AO U 
III. DAGAAFGAGVDAFGGXFDXDFVV 
XI. VFDD7AXGDADFGGGGFGDDFXX 

1 7 H JO 31. il 23' 34 3S U37 38 «o Ml H ¥3 Ht VfJU> 
III. XGFXFDXDDAGADDGVADDVDDG 
XI. DAFDDXGGAVGAGDVDFDFDDDG 



III 

XI. 



H7^9H<I SoSl S3. S3 M SSSVS7 S£ SI t>0 61 63 LH 6S 46 67 4 / 

. AFGAV GDGXDDDAVFVDDFDAAA 



AFAFDAAAGVAVFGGVADDGDDF 



70 7A 71 7J 7V 7S 7b 77 78 79 80 3l 81 83 8S gb 87 88 « 80 
III. ADXAGDXAGGDDAVGVFGDVFVD 
XI. GFVDDADFGAF DFVD.DFVVV ADA 



III. 

XI. 



‘ttJlg 9S 3k 31 *8 32 too ie» »o*/Q3 m icSiaL i o7 iqS to9 Uo m m i»j M Ilf 



G G X G G A F F 
GDXFXXXF 



V F D A X G D D D G D A F D A 
F D-X GDFDGFDDFGDA 



lib/ 17 US ny no qN Hi m IH 12£ Ufa 117 129 >18 130 13 1131 m l3Hl3SI&\Vi3* 
III. DGGADDGDXAFV'DFDXFVGDDVA 
XI. GFAAGGADXDGVDGAVGVDFDDF 

* 

L3fl Ufami m Z43 m rn ia2 L5AM J£l l£l l£l ISJil mwisiitolU 

III. VFDDDVFAGDFFFXAADFADGGV 
XI. XGAGXFGVFVVDGVDXDFFFXGX 

i^ians /bf/tt ibT Ifcg J49 17017/ m m mustjL uj 178171 teots i tana* m 
III. FDAVDGXFVDAAVGDXFGGDDXG 
XI. GXAGAGVGDVVXGF.VDXDDXFVD 



18b 

III. D A 
XI. D X 

FIGURE 68. 

£. It has already been noted that beginning with the first letter 
of any one of the cryptograms, the typo of alternation for column 1 is -|-. 
It is therefore not astonishing to find, within the first 10 letters, an 
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alternation of the -+■ type. Note how the V f & and X* s fall in the odd 

positions, the F*s in the even. Thus: 

12 34 5 6 7 8 910 
III. DAGAAFGAGV 
XI. VX DDVAXGDA , 

It is seen that there are 2 V*s which fall in odd positions (1 and 5), 
but one V falls in an even position (10). There is an X, which falls in 

• r 

an odd position (7); there are 2 F*s, which fall in even positions (2 and 

6) . Unquestionably, then, the .-type of alternation, at least for the 

first 10 letters in each of these cryptograms, is -f-. 

h. Take the next section of 10 letters in- these two cryptograms. 

The letters are as follows: 

11 12 13 U 15 16 17 18 19 20 
III. DAFGGXFDXD 
‘ XI. DFGGGGF;GDD 

Here there are 4 J»s; 3 of them fall in odd positions. (13, 1?» 17) » end 

one falls in an oven position (12). There are 2 X’-s; one falls in an odd 

position (19), one in an -even position. There are no V*s among those 

letters. So far as the evidence afforded by the F»s is concerned, it 

would appear that this section. of text shows the type 2 or type" of 

alternation of components, since in type 1 or "■+ type" the F»s occupy 

even positions and hero the majority of them occupy odd positions. But so 

far as the X*s are concerned, the ovidonce is equally balanced: one X 

falls in an odd position, one in an even position. There being no V»s, 

no conclusions can be drawn from this letter. To be guided solely by 

the ovidonce afforded by the 3 f’s may be unwarranted. Is it not possible 

1 i 

to weight the frequencies of the letters so that it will be unnecessary to 
rely merely upon a few of them and the evidence afforded by all the 
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letters can be taken Into account? 1 Why not assign frequency weights 
according to the two distributions in Figs. 66 and 67? -The figures then 
become as follows: 



Odd ( 1 st, 3 d, . ..) letters 

A D F G V X 

= * * $ \ % 

I S * - 

3 11 3 8 11 6 

Total - 42 letters 



Even ( 2 d, 4th, ...) letters 
A D F G V X 

* s * $ = ■ 

* S 

4 10 11 5 4 1 

Total - 35 letters 



FIGURE 69. 



Since the odd letters have a total frequency of 42 , the even, a total 
frequency of 33, for purposes of equalizing the distributions in apply- 
ing the weights it seems advisable to deduct 1/6 from the total when 
applying the weights to odd letters. 

i. 1 Now in applying these weights to the letters, it must be borne 
in mind that since a transposition rectangle with an odd number of 
columns is Involved, half of the letters are class 1 components, the 
other half are class 2 components. Hence, in finding the frequency value 
of the letters it is necessary to apply the weighted frequencies to 
alternate letters in the' sections, as shown in Fig. 70. 



11 12 13 14 15 16 17 18 19 20 
III. DAFGGXFDXD 
XI. • DFGGGGFGDD 



Distribution of odd letters Distribution of even letters 



ADFGV X 



O-3-3-3-O-I 



A D F G V X 



• I-3-I-4-O-I 

FIGURE 70. _ 



-G 



* 
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These distributions, when evaluated in accordance with Fig. 69 * yield a 
total frequency value of 126; when evaluated in accordance with Fig. 69 
reversed, yield a total frequency value of 143* The detailed calcula- 
tions are as follows: 

i 

Fig. 69 normal 



(Odd letters as 61 * 8 , 
even letters as © 2 »s) 

Fig. 69 reversed 



odd letters as 02 * s) 

J. Now the frequency sums here obtained (148 vs 156 ) indicate that 
an alternation of the type ©2 0 ^ ©2 is in effect, that is, if a 

beginning is made with position 11 , the type of alternation is 
Since the type of alternation for the first 10 letters is "4" and for the 
second 10 letters the reversal in alternation would indicate that 
column 1 of the transposition rectangle ends somewhere zxear the 10 th 
letter. This same sort of reversal 'takes place after the 20th letter, 
as shown by the calculation in Fig. 71. 



fo 


(3) 


4 


3 


(ID 


4 3 


(3) 


4 3 (8) 4- 0 (11) 






4- 


1 


(6) : 


= 72 




u 


(4) 


+ 


3 


(10) 


-1- 1 


(11) 


4 4 (5) 4 0 ( 4 ) 






4- 


1 


(1) : 


: 66. 


72 


- 32 z 60; 60 -J- 66 


(i 


(3) 


4 


3 


(11) 


4* 1 


(3) 


4 4 ( 8 ) '4 0 ( 11 ) 


J 




4- 


l 


(6) : 


: 77 




- 


Is 


(4) 


4- 


3 


(10) 


-h 3 


(ll) 


4 3 (5) 4 0 (4) 






4" 


1 


(1) : 


: 79. 


77 


- = 64 ; 64 4 79 
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21 22 23 24 25 26 27 28 29 30 
III. FVVXGFXFDX 
XI. FXXDAFDDXG 



Distribution of odd letters 



Distribution of even letters 



A D F G V X 



A D F G V X 



1 - 2 - 2 - 1 - 1-3 



O-2-3-I-I-3 



Fig. 69 normal 



(Odd letters 01*8, 
even letters as 02 f s) 

Fig. 69 reversed 



(Even letters as 01*3, 
odd letters as @2^s) 



r i (3) 4- 2 (11) ■+ 2 (3) + 1 (8) + 1 (11) 

+ 3 (6) s 68; deduct 1/6 = 57 



0 (4) 4- 2 (10) -4 3 (ID 4- 1 
(5) -t- 1 (4) + 3 (1) 



= ii 

122 



(0 (3) 4- 2 (11) -f 3 (3) 4- 1 (8) 4“ 1 (11) 

-+■3(6)= 68; deduct 1/6 = 57 



yL (4) 4- 2 (10) -I- 2 (11) 4* 1 
(5) *+■ 1 (4) 4- 3 (1) 

FIGURE 71. 



*J8L 

115 



1 

Beginning with 21st position, the alternation is of type 0-^y 0 2 -> 0^ 
hence it is of the "4”" type. Again the reversal m type of alternation 
occurs in passing from the 2d set of 10 letters to the 3d set, and this 
indicates that column 2 of the transposition rectangle ends somewhere 
noar the 20th letter. But, fortunately, this time the exact location 
of the break is definitely indicated: the simultaneous appearance of V 
and X in the sequent positions 22 and 23 leads to the idea that letter 22 
marks the end of column 2 and letter 23 marks the beginning of column 3* 
There is nothing of an absolute nature in this point : it is merely an 
indication based upon probabilities and does not constitute a conclusive 
proof by any means. Now if there is this definite break at the end of 22 
letters it means that columns 1 and 2 must each contain 11 letters. The 
calculations have heretofore been based upon sections of 10 letters and 
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* 



the results are therefore modified as shown in the following calculation: 

FIRST SECTION (Letters l-ll) 

12345678930H 
III. D A G A A F G A G V D 
XI. VFDDVAXGDAD- 

Distribution of odd letters Distribution of oven letters 

A D F G V X A D F G V X 

= “ r 1 ' 

1-5-0- 3-2-1 5-1-2-1-1-0 

Weighted values of distributions: 

t 

On basis of Fig. 69 normal (odd letters as 9^*s, even letters as 
0 2 is): 

1 (3) 4- 5 (ID + 0 (3) + 3 (8) + 2 (11) -h 1(6) = 110; deduct 1/6 = 92 

5 (4) 4- 1 (10) + 2 (11) -(- I (5) 4- 1 (4) 4- 0 (1) =, 62 _62 

Total 154 

On basis of Fig. 69 reversed (even letters as 9^’ s, odd letters as 02 f s): 

5 (3) -f- 1 (ID 4- 2 (3) 4 - 1 (8) 4 “ 1 (ID 4* 0 (6) = 51; deduct 1/6 = 42 

1 (4) -h 5 (10) 4 - 0 (11) 4 - 3 (5) + 2 (4) -j- 1 (1) = 78 JZ8 

Total 120 

The type of alternation is 9^ 02“^®1' or "4’ w . 

SECOND SECTION (Letters 12-22) 

12 13 14 15 16 17 18 19 20 21 22 
III. AFGGXFDXDFV 
XI. FGGGGFGDDFX 

Distribution of odd letters Distribution of even letters 

A D F G V X A D F G V X 

' ~ z - l ' - 

O-I-5-3-O-I - 1-3-1-4-1-2 
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Weighted, values of distributions: 

On basis of Fig. 69 normal (odd letters as 6^'s, even letters as @2*8): 

0 (3) -|- 1 (ll) 4- 5 (3) + 3 (8) + 0 (11) -hi (6) 1 56; deduct 1/6 = 47 

1 (4) 4- 3 (10)' 4- 1 (11) -f 4 (5) ,4- 1 (4) + 2 U) = 71 Jfi. 

Total 118 

On basis of Fig. 69 reversed (even letters as 0^ T s, odd letters as 02 ? s): 

1 (3) +'3 (ID + 1 (3) + 4 (8) -h 1 (11) + 2 (6) = 94',' deduct 1/6 r ?8 

0 (4) 4- 1 (10) -j- 5 (ID 4" 3 (5) 4“ 0 (4) + 1 (1) = 81 _81 

Total 139 

Since the best values are obtained on the basis of Fig. 69 reversed, the 

type of alternation for the 2d section of 11 letters is therefore 

again 0-j-^ © 2 -^ © 1# or "4“". 

THIRD SECTION (Letters 23-33) 

23 24 25 26 27 28 29 30 31 32 33 
III. VXGFXFDXDDA 

XX. XDAFDDXGGAV 



Distribution of odd letters Distribution of evon letters 



ADF G V X- 



ADFG-VX 






2-3-0-2-2-3 ‘ 1-3“ 3“ 1-0-2 

Weighted values of distributions: " 

On basis of Fig. 69 normal (odd letters as 0]_ f s, even letters as ©2 f s): 

2 (3) -H 3 (ID 4- 0 (3) -1- 2 (8) 4" 2 (11) 4- 3 (6) = 95; deduct 1/6 = 79 

1 (4) 4“ 3 (10) 4* 3 (ID -I- 1 (5) 4- 0 (4) 4- 2 (1) = 74 74 

Total 153 

On basis of Fig. 69 reversed (even letters as 0-,’s, odd letters as 0 5 *s): 

* 

1 (3) 4- 3 (11) 4* 3 (3) 4 - 1 (8) 4“ ° UD 4" 2 (6) = 65 ; deduct 1/6 = 54 

2 (4) 4- 3 (10) 4- 0 (ll) -|-2(5) -1-2 (4) 4- 3 (1) = 59 _J2. * 

Total 113 
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w % • 

Since the best values are obtained on the basis of Fig. 69 normal, the 
type of alternation for the 3d section of 11 letters is 9^—^- ®2” ®i» 
or n -j-". 

k. Now if columns 1 and 2 contain 11 letters, and the total number 
of letters is 186, the transposition rectangle obviously has 17 columns, 
there being 16 long columns of 11 letters and one short column of 10 
letters (J17 x 11) - 1 - 186] . 

1_. There is another cryptogram which also contains but one short 
column, viz, VII, of 254 letters, (Tl7 x 15) - 1 ; 254j . The columns of 
this cryptogram contain 4 more letters than the corresponding columns of 
III and XI. Assuming, momentarily, the last column to be the short one, 
cryptogram VII may be added to the superposition of III and XI, provided 
these sets of 4 additional letters are accounted for. This ha3 been 
done in Fig. 72. In that figure the 4 extra letters pertaining to crypto- 
gram VII are shown as falling under the last letters of the columns of 
cryptograms III and XI, but this is only an arbitrary placement. It is 
sufficient to place these extra letters in such positions as will make 
the first one of the series begin in an even position. 

m. Since the transposition rectangle is now known to be 17 col umns 
wide, the data in Fig. 69 may be enlarged to correspond to this infomation 
For example, whereas in originally constructing Fig. 69 tho first column 
of cryptogram I was assumed to have only 8 letters (to correspond to a 
key of 25 numbers), it may now be extended to a column of 12 letters, and 
so on. The additional portions used to mako the distributions in Fig. 

74 are shown underlined in Fig. 73. 
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D 


G 



III. 

n. 

VII. 



m ut&ni in 



XFGGBBXGBA 
BXBBXFVBBX 
AFVFXFAAVB 
D F V D 
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Letters taken 



VDIXXXiV FDFVD 

VDAAVD 

DAGAAFGAGV 

ADKVTX 

mrnsmvm. 

GDGFXAG 




IE353EBSSSB1 H23?a33B 



vii 

VIII 

IX 

X 

XI 

XII 



' bsm a 



DGVVGFXG 
GDUDDXVGVD 
130 DGDDFVF 

186 VFDDVAXGDA 

224 XFnFXVVDVmVD 



FIGURE 73- 

The new frequency weights are therefore as follows: 



Odd (1st, 3d, *«•) letters 
A D F G V X 

’= M H i 

§ 1 1 s 

4 14 5 11 15 10 

Total = 59. 



Even (2d, 4th, ...) letters 
A D F G V X 

1 11! 

U 

9 15 H 8 7 2 
Total = 55* 



FIGURE 74. 



Since the two totals are quite close together, no correction need be 
made of the nature of that made in preceding calculations, where 1/6 was 
deducted from the total values of odd letters. 

n. Beginning with position 23, in the caso of cryptograms III and 
XI the next 11 letters, and in the case of cryptogram VII the next 15 
letters are clearly of the ’* -f— 11 type of alternation. The data are as 
follows: 



m. 

XL. XDAFDDXGGAV 
VII. VDVFFADAVAV 

F V G G 
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Distribution of odd letters 
A D F G V X 

2-4-I- 3-7-3 

Weighted values of distributions: 



Distribution of even letters 
A D F G V X 

4-4" 5-2-0- 2 



On basis of Fig.- 74 normal (odd letters as ©^s, even letters as Qg's) : 

2 (4) +■ 4 (14) f 1 (5) + 3 (H) + 7 (15) + 3 (10) = 237 

1 

4 (9) 4-4 (15) -f 5 (14) + 2 (8) '+ 0 (7) + 2 (2) = 186 

Total • • • *423 

On basis of Fig, 74 reversed (even letters as B^’s, odd letters as Bg’s): 

4 (4) + 4 (14) + 5 (5) 4- 2 (11) + 0 (15) 4- 2 (10) = 139 

2 (9) 4- 4 (15) 4* 1 (14) 4* 3 (8) 4- 7 (7) + 3 (2) = 1&. 

Total ....310 

Since the greatest total is obtained on tho basis of Fig. 74 normal, the 

1 

type of alternation for the 3d section of letters is ©j— ^ ®i» or 

"+■- ' ' 

*\ 

£. Continuing the foregoing process with the letters beyond position 

1 

33, tho data are as follows: 



III. _ GADDGVADDVD 
XI. ' GAGDVDFDFDD 
VII. ADAAFVFDVFD 

X F X X 



Distribution of odd letters 
A D F G V X 



Distribution of even letters 



A D F G V X 



3-8-I-O-3-2 

Weighted values of distributions: 



3-5-5-4-2-1 



On basis of Fig. 74 normal (odd letters as 6^ ? s, even letters as ©2*3) 
3 (4) +■ 8 (14) 4U5) +0 (11) -I- 3 (15) + 2 (10) : 194 
3 (9) 4- 5 (15) 4- 5 (14) 4- 4 (8) -f- 2 (7) 4* 1 (2) = 220 
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On basis of Fig. 74 reversed (even letters as e^s, odd letters as ©2*3): 

3 (4) 4* 5 (14) 4" 5 (5) -I- 4 (11) H- 2 (15) 4“ 1 (10) = 191 
3 (9) 4- 8 (15) 4- 1 (14) f 0 (0) t 3 (7) 4 2 (2) = 189 

Total ■ « ■ 38O 

Since the distribution begins here with an even-numbered position (34)* 
and the greatest total is obtained on the basis of Fig. 74 normal, hence 
the alternation for the 4th section or column is of the type ©2 — 4 8^—^ © 2 - 
or 

£. (1) The data for letters beyond position 44: 

45 46 47 48 49 50 51 52 53 54 55 
III. DGAPGAVGDGX 

XI. DGAFAFDAAAG 

VII. GDXDDFVDFFX 

D V F X 

Distribution of odd letters Distribution of even letters 

ADFGVX ADFGVX 




4-5-1-3-3-4 3-4- 6- 4-0-0 

Weighted values of distributions: 

On basis of Fig. 74 normal (odd letters as 6-^3, even letters as © 2 »s): 

4 (4) 4- 5 (14) 4- 1 (5) 4“ 3 (ID + 3 (15)4- 4 (10) = 209 

3, (9) 4- 4 (15) + 6 (14) + 4 (S) f 0 (7) + 0 (2) r 20£ 

Total • • *412 

On basis of Fig. 74 reversed (even letters as 0^ f s, odd letters. as Sg’s): 

3 (4) 4- 4 (14) 4- 6 (5) 4- 4 (11) 4- 0 (15) 4* 0 (10) r 142 

4 (9) 4- 5 (15) 4- 1 (14) 4* 3 (8) +• 3 (7) 4- 4 (2) = 178 

Total ....320 

Since the distribution starts with an odd position (45) and the greatest 
total is obtainod on the basis of Fig. 74 normal, the type of alternation 
for the 5th section or column is ©1“^ ©2 -4 ©!> or h 4*"* 
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The types of alternation for the first 5 columns, which are all- 
long columns, is therefore 4* 4" 4 — -{-• Since cryptograms III and XI 

i 

contain but one short column, it is advisable to be 1 on the lookout for 



it as the work progresses. It is possible to continue with the process 
detailed above. For example, the calculations for the next or 6th section 



of 11 letters are shown below: 



56 57 56 59 60 61 62 63 U 65 66 
III. DDDAVFVDDFD 

XT. VAVFGGVADDG 

VII. V.ADXVAXDVXA 

' F F V D 

! 

Distribution of odd letters Distribution of even letters 



ADFGVX ADFGVX 




5 - 4 - 4 - 1 - 1-2 ~ l- 7 -l- 2 - 8-1 



Weighted values of distributions: 

On basis of Fig. 74 normal (odd letters as 0^ r s, even letters as 02 , s): 

» / 

5 (4) 4- 4 (14) 4-4(5) 4-1 (11) 4- 1 (15) 4- 2 (10) = 142 

1 (9) 4- 7 (15) 4- 1 (14) 4- 2 (8) 4- 8 (7) 4* 1 (2) = 202 

Total 344 

On basis of Fig. 74 reversed (even letters as 0^’s, odd letters as : 

1 (4) 4- 7 (14) 4- 1 (5) 4- 2 (11) 4- 8 (15) 4- 1 (10) r 259 

5 (9) 4“ 4 (15) 4- 4 U4) 4- 1 (8) 4- 1 (7) 4- 2 (2) = 180 

To b&l • • • • 439 

r 

Since the distribution starts with an even position (56) and the greatest 

\ 

total is obtained on the basis of Fig. 74 reversed, the type of alternation 

for the 6th section or column is 0^ ©2 — ^ &i, or 

1 ' 1 
r*v But perhaps advantage should be taken of the availability of 

additional cryptograms. For example, cryptogram V, of 202 letters, has 2 

1 t 

short columns jjl7 x 12) - 2 : 202]-, whereas the cryptograms thus far dealt 



% 



- 172 - 



REF ID : A56913 



with each have but one. That is, cryptogram V has one short column in 
common with cryptograms III, XI, and VII, and one additional short column 
not possessed by the latter. Can this additional short column of crypto- 
gram 7 be located? 

a. Suppose column 1 of cryptogram V is the additional short column. 
Then the letters of this column are FXFXFFIVA&FD. These 
letters when evaluated on the basis of Fig. 74 normal yield a total of 
77; when weighted on the basis of Fig. 74 reversed, a total of 144. The 
calculation is as follows: 

Distribution of odd letters Distribution of even letters 

A D F G V X A D F G;V X 

- s 

1 - 0 - 5 - 0 - 0-0 0 - 1 - 1 - 1 - 1-2 

On basis of Fig. 74 normal: 

1 (4) H- 5 (5) + 1 (15) 4- 1 U4) 4* I (8) + 1 (7) + 2 (2) : 77 

% 1 

On basis of Fig. 74 reversed: 

1 (9) 4- 5 (14) 4- 1 (14) 4- 1 (5) + 1 (ID 4* 1 (15) 4" 2 (10) z 144 
According to this calculation column 2 of cryptogram V seems to correspond 
to the type of alternation ©i — ^ ©2, that is n - M . But from previous 

work it is fairly certain that column 2 is of the "4"" type. Hence, 
column 1 of cryptogram V is not f the additional short column of that 

message. Assuming column 2 to be the extra short column, no such contra- 

) 

diction is obtained, for the calculation is as follows: 
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Assuming column 2 to be abort, tbe letters of column 3 are 

i 

XAVDAGFDVDFG. The weighted frequency value for a 
©1*— ^02 ““^-©l sequence (letters X V A F V G and A D G D D F) r 136. 
The weighted frequency value for a ©2 — > ©i — ^ ©2 sequence (letters 
A D G DDF and X V A F V G) z 109. Hence column 3 J-s a "4-" column 
which is consistent with the formula -f" "f“ “h “ + for columns 1 
to 5» as previously ascertained. 

If all the foregoing reason is correct, and column 2 is the additional 
short column for cryptogram V, it must be the next to the last column of 
the transposition rectangle. Since it is a n -j- H column, the last column 
must be a W - M one; therefore, there are 9 ,,_M columns and 8 columns. 
This definitely determines that the columns are the odd ones, the 
"-}- n columns the even ones, since in an odd-width rectangle there is one 
more odd column than even columns. 

The single short column which is common to cryptograms III, XI,' 
and VII is one of the columns beyond column 5* Assuming each possibility 
in turn, there is obtained for the type of alternation in each column 
the distributions of "•f-" and shown in Fig. 75. 

u. The correct assumption must satisfy the following conditions: 

(a) There must be 9 and 8 n -(“ n columns. 

(b) The short column must be H - n . 

Only assumptions (3) and (5), in which column 8 and column 10 are short 
columns, satisfy these conditions. Therefore, column 2 is followed by 
either column 8 or 10. Testing the combination 2-8 for monoalphabeticity 
of bipartite pairs, the distribution “shown in Fig. 76 is obtained. When 
combination 2-10 is tested, the distribution shown in Fig. 77 la obtained 
Obviously, the 2-3 combination is the better. 
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FIGURE 75. 





E (0) = .0667 x 17 x 16 = 18. 14 E (6) = .0667 x 17 x 16 = 18.14 

0, r 22 f = 4 

FIGURE 76. FIGURE 77* 

v. It is possible by introducing cryptograms with additional short 

columns to determine more of the key. Thus, it was found by U3ing crypto- 
grams Eli and VI that the first 3 numbers of the transposition key are 
l6-5“7* But the process of anagramming will yield the solution at least 
os rapidly. In this process, of course, advantage may be taken of the 
fact that the columns have been classified into the and types 

and no combinations of two or two columns need be tested, since 

1 

only combinations of the type "-j- or -f- H are permissible. 

w. The final transposition key and ths substitution checkerboard are 
shown in Fig. 78. 
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16 5 7 6 9 3 14 1 13 11 17 10 4 1Z 15 2 8 
VIKING S' CR0WNH0TEL 



A 

D 

‘F ' 

G 

V 

X 



A D F G V X 
V I 9 K N G 

7 s c 3 H o 
W H 8 T E 5 
L A 1 B 2 D 
4 F I J 0 M 
P Q U X Y Z 



FIGURE 78. 



x. All the foregoing details concern a case in which the trans- 
position rectangle has an odd number of columns. Now if the rectangle 

contains an even number of columns, this type of solution is, of course, 

letters of the 

still applicable, and in fact is easier, since the /text of the respective 
sections do not have to be distributed into odd and even letters. It is 

< 

only necessary to identify a section as being composed of initial com- 

0 

ponents or of final components. This analysis then produces a series of 

\ 

sections corresponding in number with the number of columns in the trans- 
position rectangle. This number will, of course, be even. By a careful 
study of where alternations in composition of components (0^ or © 2 ) 
occur, the division of the text into sections corresponding to long and 
short columns can be accomplished. The remaining steps are obvious and 
follow the lines elucidated in Par. 39e_“j.* 

£. The entire structure upon which this general solution rests 
is destroyed if the substitution checkerboard has been consciously 
manipulated Id impart a homogeneity to the sums of the weighted frequencies 
of the letters in its rows and columns. For example, note the following, 
checkerboard, which is not "perfect” but gives fairly homogeneous fre- 
quencies in its rows and columns. 



- 176 - 



4. X 



REF ID : A56913 

SECTION. DC 

SOLUTION or THE BIFID FRACTIONATING SYSTEM 

- Paragraph 



Review of principles underlying the cryptographic method ....... 44 

General principles underlying the solution 45 

Ascertaining the period 46 

Illustration of solution 47 

Special solutions for bifid systems 48 

Solution of trifid systems 49 

Concluding remarks on fractionating systems 5° 

Concluding remarks on transposition systems 51 

44* Review of principles underlying the cryptographic method. - a. 



Several bifid fractionating systems have been explained in previous texts 

j 

of this series. ^ In certain of those systems four basic steps are in- 
volved, two of substitution and two of transposition. Those steps may 
be briefly described as follows: (1) a process of decomposition 
(substitution), in which each plain-text letter is replaced by two 
components, 9^ and 0^, of a bifid of bipairtito alphabet; (2) a process 
of separation (transposition), in which tho 0 B c components originally 
paired together are separated; (3) a process of recombination (trans- 
position) , in which tho separated components are -combined to foim now 
pairs; (4) a process of recomposit j on (substitution), in which each new 
pair of components is given a lettor value according to the original or a 
different bifid alphabet. 

b. Ono pt the simplest and most efficient of the fractionating 
systems of the foregoing nature is that in which tho processes involved 

1 ~~ 1 

aro applied to groupings or periods of fixed length, as exemplified below. 
Let the bipartite alphabet be basod upon the 25-cell substitution 
checkerboard shown in Fig. BO. Lot the message to be enciphered be 
ONI PLANE REPORTED LOST AT SEA. Let it also bo assumed that, by 



^Sce Special Text No. 166, Advanced Military Cryptography, Sec. XL and 
Military Cryptanalysis, Part I. Sec. IX. 
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( 1 ) 



(2) 

1 2 3 4 5 



□HMEi 
O00Q0I 

saaaaa 



FIGURE 80. 



preagreement between correspondents, periods of 
5 letters will constitute the units of encipher- 
ment. pie bipartite equivalents of the plain- 
text letters are set down vertically below the 
letters. Thus: 



ONEPL ANERE 
41344 11323 
23331 23333 



PORTE DLOST ATSEA 
44223 34442 12 4'3 1 
32323 21252 2 2 5 3'2 



Recombinations are effected horizontally within the periods, by joining 



components in pairs, the first period yielding the pairs 41 , 34 , 42 , 33 * 



31* These pairs are then replaced by letters from the original checker- 
board, yielding tho following: 



0 N 


E P 


L 


A N 


E R 


E 


P 0 


R T 


E 


D L 


0 S 


T 


A T 


S E 


A 


4 1 


3 4 


4 


1 1 


3 2 


3 


4 4 


2 2 


3 


3 4 


4 4 


2 


1 2 


4 3 


1 


2 3 


3 3 


1 


2 3 


3 3 


3 


3 2 


3 2 


3 


2 1 


2 5 


2 


2 2 


5 3 


2 


L H 


0 E 


B 


M D 


D E 


E 


ft T 


E R 


R 


H ft 


T A 


W 


A P 


A G 


D 



45. General principles underlying the solution. - a. It will be 
noted that the periods in the foregoing example contain an odd number of 
letters. The result of adopting odd-length periods is to Impart a much 



'greater degree of cryptographic security to the system than is the case 
when even-length periods are involved. This point is worth while 

1 

elaborating upon to make its cryptanalytic significance perfectly clear. 
Note what happens when an oven period is employed: 



ONEPLA N E R E P 0 RTEDLO 

413441 132344 223344 

233312 333332 323212 

LHLREA NRftEED TEQDDA 



• • • 
• • • 
• • • 



Now if each 6 -letter cipher group is split in the middle into two sections 

and the letters are taken alternately from each section 

(Ex. LHLREA— JLRHELA) the result is exactly the same as is 



- 179 - 




REF ID : A56913 



obtained in case a simple di graphic encipherment were in effect with the 
2-square checkerboard shown in Fig. 81. 



\ 

pBHEl 

IciQQia 

Biaatia 
■oBoa 
E3BBHQI 
■QBE] Cl 

BQLOia 
iBQQa 



LJj 

FIGURE 81. 



ONEPLA- N E R E P 0 
L R HE LA NEREQD 



For example, ON p z LR C ; EP^ - HE 0 ^ and so on. Encipherment of this sort 
brings about a fixed relationship between the plain-text digraphs and 
their cipher equivalents, so that the solution of a message of this type 
falls under the category of the cryptanalysis of a case of simple di- 

2 

graphic substitution, once the length of the period has been established. 
The latter step can readily be accomplished, as will be seen presently. 

In brief, then, it may bo said that in this system when encipherment is 
based upon even periods the cipher text is purely and simply digraphic 
in character, each plain-text digraph having one and only one cipher- 
text digraph as its equivalent. 

b. But the latter statement is no longer true in the case of odd > 
periods. Note, in the example under Far. 44b, that the cipher 
equivalent of the 1st plain- text digraph, of the 1st group, ON, is im- 
posed of the initial and final components of the letter L Q , the final 
component of the lotter 0„, and the initial component of the letter E„. 
That is, three different cipher lettors, L, 0, and E, are involved in the 



* 



An example of tho solution of a cryptogram of this type was given in 
Military Cryptanalysis. Part I. Sec. IX. 
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composition of the cipher equivalent of one plain-text digraph, ON. 



Observe now, in the following examples, that variants may be produced for 



the digraph ONp. 

ON EP L ON TH E 
41 34 4 41 23 3 
23 33 1 23 24 3 
LH OE B LR DD P 
TZ-SID XLSTD 



ON CR U 
41 22 1 
23 13 4 
IT AB H 



PR ON G 
42 41 2 
33 23 5 
OL RD K 



CO NT I 
24 12 2 
12 32 4 
IA CR I 



PONG I 
44 12 2 
32 35 4 
^RR Y 



AT 10 N 
12 24 1 
22 42 3 
AI AI R 



c. The foregoing examples fall into two classes. In the first, 
where the 0 of ONp falls in an odd position in the period, the first 
letter of the trigraphic cipher equivalent must be on L c , the second must 
be one of the 3 letters in the 2d column of the substitution checker- 
board, the third must be one of the 5 letters in the 3d row of the 
checkerboard. Therefore, L c may combine V7ith 5 * 5 or 25 pairs of letters 

to foim the 2d and 3d letters of the 3~letter equivalent of ON . In 

p 

the other class, where the 0 of QN p falls in an even position in the 
period, the 1st letter of the equivalent must be one of the 5 letters in 
the 4th column of the checkerboard, the second must be one of the 5 
letters in the 1st column, and the 3d letter must be R c . Therefore, R c 
may combine with 5 x 5 or 25 pairs of letters to form the 1st and 2d 
letters of the 3"lotter equivalent of ONp in this position in the period. 
Hence, ONp may be represented by 50 trigraphic combinations; the same is 
true of all other plain-text digraphs. Now if the system based >ipon even 
periods is considered as a simple digraphic substitution, the foregoing 

i 

.i 

remarks lead to characterizing the system based upon odd periods as a 
special type of digraphic substitution with variants, in which 3 letters 
represent 2 plain-text letters. 

d. However, further study of the odd-period system may show that 
there is no necessity for trying to handle it as a digraphic system with 
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variants, which would be a rather complex affair. Perhaps the matter 
can be simplified. Referring again to the example of encipherment in 
Par. 44b: 



0 N 


E P 


L 


A'N 


E R 


E 


P 0 


R T 


E 


D L 


0 S 


T 


A T 


S E 


A 


4 1 


3 4 


4 


1 1 


3 2 


3 


4 4 


2 2 


3 


3 4 


4 4 


2 


1 2 


4 3 


1 


2 3 


3 3 


1 


2 3 


3 3 


3 


3 2 


3 2 


3 


2 1 


2,5 


2 


2 2 


5 3 


2 


L H 


P E 


B 


M D 


P E 


E 


Q T 


E R 


R 


H ft 


T A 


W 


AP 


A G 


D 



Now suppose that only the cipher letters are at hand, and that the period 

v> 

is known. The 1st cipher letter is L, and xt is composed of two numerical 
components that come from the 1st and 2d positions in the upper row of 
components in the period. These components are not known, but whatever 
they are the ifirst of them is the "1st component of L, the second of them 
is tho. 2d component of L. Therefore, for cryptanalytic purposes, the 
actual but unknown numerical components, may be represented by the 

s * 

symbols and L 2 , the former referring to the row coordinate of the 

substitution checkerboard, the latter to the column coordinate. The 

same thing may be done with the components of the 2d cipher letter, the 
* 

3d, 4th, and 5th, the respective components being placed into their 

/ 

proper positions in the. period. Thus: 



Components 



f Li L2 Hi H2 Oi 
O 2 Ei E 2 Bi B 2 



■. Cipher ..... L H 0 E B , 

Now let the actual plain-text letters be set into position, as shown at 
the right in the two diagrams below. 

1 

1 

0 N E P L 



Plain text . • • P N -E P L 

Components . . .J4 1 3~4 4 

12 3 3 3 1 _ 

Cipher LH OE B 



Li L2 Hi H2 Oi 
O2 Ei E2 Bi B2 
L E 0 E B 



By comparing the two diagrams it becomes obvious that Lj_, and 0^ all 
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Plain .. 
Com- 
ponents. 

Cipher . 



represent the coordinate 4; H^, E^, E 2 , and all represent the co- 
ordinate 3 * and so on. If this equivalency were known for 'all the 5° 
combinations of the 25 letters with subscript 1 or 2 there would be no 
problem t for the text of a cryptogram could be reduced to 25 pairs of 
digits representing monoalphabetlc encipherment. But this equivalency 
is not known in the case of a cryptogram that is to be solved; basically 

r 

the problem is to establish the equivalency. 

Ll 

e. It is obvious that the vertical pair of components 0 2 represents 

L 2 

0p t the vertical pair represents Np, and so on. The complete example 
therefore becomes: 

0 N E P L A N E R E PORTE D L 0 S T A T S E A 

L 1 l 2 % H 2 0 X M;l M 2 Di D 2 Di Qi Q, 2 Tj_ T 2 E^ % H 2 Qi Q, 2 T]_ A]_ A 2 P 2 A^ 

°2 E 1 e 2 b 1 B 2 D 2 % *2 E 1 E 2 E 2 R 1 R 2 R 1 R 2 T 2 A 1 A 2 W 1 w 2 A 2 °1 G 2 D 1 P 2 

LHOEB MDDEEQTERRHQTAWAPAGD 

f . Note that a plain-text letter in an odd position in the period 

has its components in the order @^@ 2 > in an even position in the period 

the components of a plain-text letter are in the order 3^. For example, 

note the OJ in the 1st period (= L-i) and in the 3d period (s Qo). This 

P ( 02> ( Hi) 

distinction must be retained since the component Indicators for rows and 

columns are not interchangeable in this system. From this it follows 

t 

that the vertical pairs of components representing a given plain-text 
letter are of two classes: 0^0 2 and 9 2 3i» and the two must be kept 
separate in cryptanalysis. 

£. Now consider the equivalent of 0. in the 1st period. It is cam- 
Ll P 

posed of 0^. This is only one of a number of equivalents for Op in an odd 
position in the period. The row of the substitution checkerboard indicated 
by may be represented by 4 other components) since that row contains 5 
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letters. Therefore the upper component of the 6g equivalent of Op may- 
be any- one of 5 letters. The same is true of the lower component. 

Hence, Op in an odd position in the period may be represented by any one 
of 5 x 5 = 25 combinations of vertical components is. the sequence 
01—* ©2- Op in an even position in the period may be represented by any 
one of a similar number of combinations of vertical components in the 
reverse sequence 8-j-J 0^. Thus, disregarding the position in the period, 
this system may be described as a mono alphabetic substitution with 
variants, in which every plain-text letter may be represented by any 
one of 50 different component-pairs. But in studying an actual crypto- 
gram in this system, since the position (odd or even) occupied by a 
cipher letter in the period is obvious after the length of the period 
has been established, a proper segregation of the cipher letters will 
permit of handling the cipher letters in the two classos referred to 
above, in which case one has to deal with only 25 variants for each 
plain-text letter. Obviously, the 25 variants are related to one another 
by virtue of their having been produced from a single checkerboard of 
but 25 letters. This relationship can be used to good advantage in re- 
constructing the checkerboard in the course of the solution and will be 
discussed in its proper place. 

h. How if the foregoing encipherment is studied intently several 
important phenomena may be observed. Note, for instance, how many times 
either the 0'^ or the 62 component coincides with the plain-text letter of 
which it is a part. In the very first period the 0^ has an Og under it; 
in the same period the Ep has an E2 under it. The same phenomenon is 
observed in columns 3 and 5 of the 2d period, in column 3 of the 3<i period, 
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and in column 1 of the 5th period. In column 5 of the 3 d * 4th, and 5th 
periods the © 1 components coincide with the respective plain-text letters 
involved. There are, in this short example, 9 cases of this sort, giving 
rise to instances of what seems to be a sort of self-encipherment of 
plain-text letters. How does this come about? And is it an accident 
that all these cases involve plain-text letters in odd positions in the 
periods? 

i, If the periods in the foregoing example in subparagraph £ are 
studied closely the following observations may be made. Because of the 
mechanics of encipherment in this system the 1st cipher letter and the 
1st plain-text letter must come from the same row in the substitution 
checkerboard. Since there are only 5 letters in a row in the checker- 
-board the probability that the two letters referred to will be identical 
is 1/5. (The identity will occur every time that the coordinate of the 
row in which the 2d plain-text letter stands in the checkerboard is the 
same as the coordinate of the column in which the 1st plain-text letter 
stands.) The same general remark applies to the 2d cipher letter and 
the 3d plain-text letter; as well as to the 3d cipher letter and the 5tb 
plain-text letter: in these cases the two letters must come from the same 
row in the checkerboard and the probability that they will be identical 
is likewise 1/5. (The identity in the former case will occur every time 
that tho coordinate of the row in which the 4th plain-text letter stands 
in the checkerboard is the same as that of the column in which the 3d 
plain-text letter stands; in the latter case the identity will occur 
every time that the coordinate of the column in which the 1st plain-text 
letter stands is the same as that of the column in which the 5th plain-text 
letter stands.) The last of tho foregoing sources of identity is 
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exemplified in only 4 of the 9 cases mentioned in subparagraph h above. 

_ c 

These involve the 5th plain-text letter in the 3d, 4th and 5th periods, 

i 

i ' 

and the 1 st letter in the 5 th period, wherein it will be noted that the 

© 1 component standing directly under the plain-text letter is identical 

' * « 

with the latter in each case. 

j. But how are the other 5 cases of identity brought about? 

Analysis along the same lines as indicated above will be omitted. It will 
be sufficient to observe that in each of those cases it is the ©2 CQm ~ 
ponent which is identical with the plain-text letter involved, and again 
the probability of the occurrence of the phenomenon in question is 1 / 5 * 

k. Since the probability of the occurrence of the .event in question 
is 1/5 for 8 -^ components and 1/5 for ©2 components, the total probability , 
from either source of identity is 2 / 5 . This probability applies only to 

the letters occupying odd positions in the period, and it may be said that * 
in 40 $ of all cases of letters in odd positions in the periods the one or 
the other of the two cipher components will be identical with the plain- * 

text letter. 

1_. As regards the plaintext letters in even positions, analysis 
will show why only in a very few cases will either of the cipher 1 com- 
ponents coincide with the plain-text letter to which they apply. Now the 
method of finding equivalents in the substitution checkerboard is to take 
the ls,t component as the row coordinate indicator and the 2 d component as 
the column indicator; a reversal of this order will give wholly different 

* 

letters, except in those 5 cases in which both components are identical. 

(The letters Involved are those which occupy the 5 cells along the diagonal 
from the upper left-hand corner to the lower right-hand corner of the 
checkerboard.) Now in every case of a letter in an odd position in a perioc 

, - 136 - 



REF ID : A56913 



the two vertical components are in the 0 ^ 0 2 order, corresponding to the 
order in which they are noimally taken in finding letter equivalents in 
the checkerboard. But in every case of a letter in an even position in a 
period, the two vertical components are in the order &2 e i' is a 

reversal of the normal order. It has been seen that in the case of 
letters in odd positions in the periods the probability that one of the 
components will coincide with the plain-text letter is 40#* The reason 
which led to this determination in the case of the odd letters is exactly 

1 

the same as that in the case of letters in even positions, except that in 
the final recombination-substitution process, since the components in 
the even positions are in the order, which is the reverse of the 
normal order, Identity between one of the components and the plain-text 
letter can occur in only 1/5 of the 40$ or 8 # of the cases. It may be 
said then that in this system 48$ of all the letters of the plain text 
will be "self -enciphered" and represented by one or the other of the two 
components; in the case of the letters in odd positions, the amount is 
40 $, in the case of letters in oven positions, it is 8 $. 

m. Finally, what of the peculiar phenomenon to be observed in the 
case of the 1 st column of the 5 th period of the examplo in subparagraph 
h? Here is a case wherein tho plain-text valuo of a pair of superimposed 
components is unmistakably Indicated directly by the cipher components 
themselves. Studying the cipher group concerned it is noted that it 
contains 2 A Q l s separated by one, letter, that is, the A*s are 2 intervals 
apart. This situation is as though the plain-text letter were entirely 
self-enciphered in tills case. Now it is obvious that this phenomenon 
will occur in the case of periods of 5 letters every time that within a 
period a cipher letter is repeated at an interval of 2 , for this will 
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bring about the superimposition of a 0- L and 0g with the same principal 
letter and therefore the plain-text letter is indicated directly. This 
question may be pertinent: how many times may this be expected to happen? 
Analysis along the lines already indicated will soon bring the answer 
that the phenomenon in question may be expected to happen 4 times out of 
100 in the case of letters in odd positions and only 8 times out of 1000 
in the case of letters in even positions. In the latter cases the 
letters involved are those falling in the diagonal sloping from left to 
right in the substitution checkerboard. 

n. All of the foregoing phenomena will be useful when the solution 
of an example is undertaken. But before coming to such an example it is 
necessary to explain how to ascertain the period of a cryptogram to be 
solved. 

46. Ascertaining the period. - a. There are several methods avail- 
able for ascertaining the length of the period. The simplest, of course, 
is to look for repetitions of the ordinary sort. If the period is a 
short one, say 3i 5» 7 letters, and if the message is fairly long, the 
chances are good that a polygraph which occurs several times within the 
message will fall in homologous positions within two different periods 
and therefore will be identically enciphered both times. There will not 
be many such repetitions, it is true, but factoring the intervals between 
such as do occur will at least give same clue, if it will not actually 
disclose tho length of the period. For example, suppose that a 7-letter 
repetition is found, the two occurrences being separated by an interval 
of 119. The factors of 119 are 7 and 17; the latter is unlikely to be the 
length of the period, the former^quite likely. 
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b. If a polygraph is repeated hut its two occurrences do not fall 
in homologous positions in two periods, there will still he manifestations 
of the presence of repetition but the repeated letters will he separated 
by one or more intervals in the periods involved. The number of repeated 
letters will be a function of the length of the polygraph and the length 
of the period; the interval between the letters constituting the repetition 
will be a function of the length of the period and the position of the 
repeated polygraph in two periods in which the two polygraphs occur. Note 
what happens in the following example: 



SENDTHR 

4 3 1 3 2 3 2 

5 3 3 2 2 4 3 
P N R G E T P 



E E M E N D 0 
3 3 13 13 4 
3 3 1 3 3 2 2 
E N N P B E T 



W N'T 0 E N D 
5 1 2 4 3 1 3 
2 3 2 2 3 3 2 
7 I B D D R D 



0 P E N D I C 
4 13 13 2 2 
2 5 3 3 2 4 1 
LBDTXDL 



0 T T R 0 A D 

4 2 2 2 4 1 3 
2 2 2 3 2 2 2 
OTLDTDT 



PNR0E TPENN PBETV IBDDR DLBDT XDLOT LDTDT 

Here the plain text contains the trigraph END 4 times. The END in the 

1234567 P 

1st period gives rise to the cipher letters . N . . E . .; in the 2d 

1 2 3 4 5 6 7 

period this trigraph also produces . . N . . E . The interval between 
the N and the E„ is 3 in both cases. Two times this interval plus one 
gives the length of the period. In this case the Initial letter of the 
repeated trigraph falls in an even position in the period in both occur- 
rences. The END in the 3d period gives rise to the cipher letters 
1234567 P 1234567 

. . B . . . D; in the 4 th period it also produces . B . . . D . The 

interval between the B c and the D c is 4 in both cases. Two timos thiB 
interval minus one gives the length of the period. In this case the 
initial letter of the repeated trlgraph falls in an ,odd position in the 
period in both occurrences. 

c. The foregoing properties of repetitions in this system afford a 
means of ascertaining the length of the poriod in an unknown example. 
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First, it is evident that a repeated trigraph in the plain text produces 
two different pairs of cipher equivalents according to whether the 
initial letter of the trigraph occurs in an odd or an even position in 
the period. The two letters constituting the repetition in the crypto- 
gram will not he sequent but will be separated by an Interval of 1, 2, 

3, ... letters depending upon the length of the period. This interval, 
however, is half of the period plus or minus ono.-' Conversely, if in a 
cryptogram there are repetitions of pairs of letters separated by an 
interval x, it is probable that these repetitions represent repetitions 
of plain-text trigraphs which occupy homologous positions in the period. 

The interval x (between the letters constituting the repetition in the 
cipher text) then gives a good clue to the length of the period: 

P-( length of period) = 2x^1. 

id. " A special kind of index is prepared to facilitate the search for 
repetitions of the nature indicated. If tabulating machinery is avail- 
able, an alphabetically-arranged index showing say 10 succeeding letters 
after each Aq, B c , C c , ... Z c is prepared for the cryptogram. Then this 
index is studied to see how many coincidences occur at various intervals 
under each letter. For example, under A c one looks to see if there are 2 
or more cases in which the same letter appears 2, 3, 4, ... intervals to' 
the right of A, a record being kept of the number of such cases under 

each interval. The same thing is done with reference to B , C , and so 

c c 

on. The tallies representing coincidences may be amalgamated for all the 
letters A, B, C, ... Z, only the intervals being kept segregated. When 

%he student mu3t remember that the text is here concerned only with cases 
in which the period is odd. In the case of even periods the interval 
separating the 2 letters is always exactly half of the length of the period. 
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tabulating machinery is not available, the search for repetitions may be 
made by transcribing the cryptogram on two long strips of cross-section 
paper, juxtaposing the strips at A, B, C, ... Z, and noting the coin- 
cidences occurring 1, 2, 3, ... up to say 10 letters beyond the juxta- 
posed letters. For example, beginning with A . the two strips are juxta- 

v 

posed wilh the 1st A on one against the 1st A on the other. Note is 
made of any coincidences found within 10 letters beyond the A*s, and a 
record is kept of such coincidences according to intervals. Keeping one 
strip in position the other is slid along to the 2d A, and again coin- 
cidences are sought. All the A f s are treated in this, way, then the 
B*s, C»s, ... Z*s. The record made of tho coincidences may consist 
merely of a tally stroke written under the intervals 1, 2, 3, ... 10. 

That interval which occurs more frequently, than all the others is 
probably the correct one. This interval times 2 plus or minus 1 is the 
length of the period. There are, therefore, only two alternatives, A 
choice between the two alternatives may then bo made by transcribing the 
text or a portion of it according to each hypothesis. That transcription 
which will most often throw the two members constituting a repetition 
into one and the same period is most likely to be correct. 

e_. Finally, for ascertaining the period there is one method which 
is perhaps the most laborious but surest. It lias been pointed out that 
this system reduces to one that may be described as monoalphabet ic 
substitution with variants. If the cipher text is transcribed into 0^ and 
8 2 components according to various assumed periods, and then a frequency 
distribution is made of the pairs of vertical components for each 
hypothesis, that period which gives the best approximation to the sort of 



- 191 - 



REF ID : A56913 

s 

distribution, to be expected for a system of monealphabetic substitution 
with 25 variants for each' letter may be taJcen to be correct. For in the 
case of an incorrect period the resultant vertical bipartite components 
are not the equivalents of the actual plain-text letters; hence such 
repetitions as occur are purely accidental and the number of such cases 

A 

would be rather small. But in the case of the correct period the 

resultant vortical pairs of components are the equivalents of the actual « 

plain-text letters; hence repetitions are causal and fairly frequent. 

Were it not for variants, of course, tho distribution would bo per- 
fectly monoalphabotic. 

47 * Illustration of solution. - a. With tho foregoing principles 
in mind, tho following cryptogram will be studied. 



K 


Z 


F 


B 


E 


I 


L 


Y 


Y 


M 


0 


c 


B 


R 


3 


L 


Z 


D. 


0 


T 


G 


B 


L 


P 


K 


Y 


W 


C 


U 


C 


c 


E 


P 


Q 


L 


A 


M 


£ 


Y 


L 


Z 


a 


X 


W 


II 


L 


R 


W 


a 


Y' 


A 


R 


W 


B 


M 


T 


I 


Z 


E 


B 


E 


L 


A 


Y 


E 


s 


0 


B 


R 


Y 


Q 


V 


B 


B 


L 


N 


X 


N 


A 


B 


Q 


B 


D 


0 


Y 


M 


Q 


D 


L 


W 


L 


N 


A 


C 


0 


X 


C 


R 


R 


G 


A 


S 


W 


Q 


B 


F 


D 


D 


T 


E 


B 


A 


M 


F 


D 


E 


T 


E 


N 


A 


K*G 


D 


F 


0 


0. 


D 


U 


B 


N 


D 


C 


L 


Y 


D 


V 


W 


B 


A 


X 


C 


A 


U 


G 


G 


X 


0 


A 


R 


T 


X 


X 


T_ 


_S 


D 


A 


x 


x 


x 


x 


0 


L 


S 


X 


A 


B 


R 


K 


R 


P 


u 


z 


W 


H 


0 


M 


T 


D 


H 


T 


S 


G 


M 


L 


S 


L 


Q 


P 


0 


U 


N 


H 


c 


I 


c 


K 


K 


A 


Q 


B 


D 


0 


F 


L 


E 


K 


A 


P 


R 


G 


S 


X 


U 


P 


0 


w 


A 


L 


M 


A 


V 


Q 


H 


L 


M 


L 


A 


X 


K 


p 


W 


S 


T 


M 


C 


X 


K 


a 


V 


H 


S 


I 


X 


S 


L 


L 


W 


X 


L 


X 


R 


S 


G 


Z 


D 


F 


K 


L 


N 


Y 


B 


X 


M 


R 


B 


N 


A 


D 


K 


T 


T 


B 


A 


E 


0 


B 


H 


w 


V 


L 


Y 


s 


X 


M 


B 


0 


W 


P 


G 


X 


K 


0 


R 


Z 


I 


U 


C 


E 


A 


D 


Y 


I 


D 


B 


L 


Z 


M 


I 


T 


A 


N 


H 


c 


A 


I 


D 


N 


C 


I 


D 


D 


0 


Y 


I 


B 


C 


N 


0 


L 


Y 


U 


u 


M 


C 


E 


P 


0 


T 


D 


H 


G 


B 


F 


U 


N 


A 


H 


L 


B 


D 


W 


X 


N 


X 


K 


K 


C 


S 


G 


T 


0 


X 


T_ 


_S 


D 


A 


x 


x 


x 


x 


C 


N 


L 


D 


K 


) 

R 


R 


F 


A 


Y 


A 


P 


M 


H 


C 


A 


N 


M 


B 


V 


G 


R 


E 


Z 


Q 


A 


T 

£ 


C 


Y 


I 


IS 


N 


D 


L 


R 


L 


G 


M 


T 


W 


E 


T 


R 


C 


V 


V 


K 


T 


E 


D 


U 


F 


D 


£ 


L 


X 


E 


E 


Q 


V 


C 


B 


L 


Y 


U 


D 


U 


G 


Y 


A 


F 


H 


N 


Q, 


L 


K 


F 


R 


U" 


C 


N 


V 


D 


L 


H 


L_ 


_Z 


_D 


R_ 


JL 


_L_ 


_K 


X 


X 


U 


P 


S 


E 


M 


C 


T 


N 


K 


T 


X 


E 


B 


0 


E 


E 


P 


G 


V 


Q, 


t' 


G 


W 


E 


R 


H 


L_ 


_Z 


JD_ 


X 


E_ 


_L_ 


K 


F 


A 


X 


I 


Y 


D 


A 


X 


Z 


L 


X 


X 


0 


R 


R 


P 


E 


R 


R 


R 


R 


N 


c. 


I 


E 
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b. The long repetitions noted in the text indicate a period of either 
5 or 7* By transcribing several lines of text into their 0-^ and 0 2 com- 
ponents according to both of these alternatives and distributing the 
vertically superimposed pairs, it is soon found that a period of 7 produces 
many more repetitions than does a poriod of 5. The entire text is then 
transcribed into its 8^ and 0 2 components according to a period of ^ (see 
Fig. 82) and complete distributions of 8^ and 8 2 8 1 vert leal pairs aro 
made, the distributions being, of course, kept separate. They are shown in 
Figs. 83 find 84* Tho individual distributions show many repetitions and 
the distributions as a whole are very favorable for a poriod of 7* 

c. Tho text is accordingly entirely transcribed into periods of 7> 
with the 0^ and 0 2 components indicated by the cipher letters in each poriod. 
Then the vertical pairs of components arc oxamined to locate cases in which 
the basic lotter of the 8^ and 0 2 suporimposod components are identical, 
whereupon the plain-text letters indicated arc at once inserted into posi- 
tion. In this oxamplo 10 such cases are found, one oach in periods 14, 22, 
26, 35, 36, 52, 59, 68, and two in poriod 74. All of these, of course, 
involve letters in odd positions in tho periods. Tho plain-text letters 
thus inserted may serve as clues for assuming probablo words. 

d. Now if only a few equivalences can bo established between a 
few of the 0^ components, or between a few of tho 0 2 components, or be- 
tween a few 0^ and 0 2 components a long step forward may be taken in the 
solution. Perhaps some infoimation con be found by studying Figs. 83 and 
84. A consideration of Fig. 83 will soon lead to the idea that each row 
of frequencies can indicato only 5 different plain-text letters, one of 
which coincides with tho indicating letter at tho loft of the row. More- 
over, in this same figure, while there are 25 rows in all, there are 
really only 5 different categories of rows, each category corresponding 
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1 


2 


■ 3 


4 


5 


EZFB1IL 


YYMOCBR 


B L Z D O T G 


BLPKYWC 


UCCEPqL 


KiK 2 ZiZ 2 FiF 2 b i 


Y l Y 2 Y l Y ^lM 2 0l 


B 1 B 2 L 1 L 2 Z 1 Z 2 D 1 


B 1 B 2 L 1 L 2 P 1 P 2 K 1 


b 1 u 2 c 1 c 2 c 1 c 2 e 1 


B 2 E 1 E 2 I 1 I 2 L 1 L 2 


°2 c 1 c 2 b 1 b 2 r 1 r 2 


D 2 O 1 O 2 T 1 T 2 G 1 G 2 


K 2 Yi Y 2WlW 2 CiC2 


E2PlP2^lQ2 L l L 2 


6 


7 


8 


9 


10 


A M E Y L Z Q. 


X TS H L R W ft 


YARWBMT 


I Z E B E L A 


Y E S 0 B R Y 


A 1 A 2 K 1 M 2 E 1 E 2 Y 1 


x 1 x 2 w 1 w 2 h 1 h 2 l 1 


Y l Y 2 A l A 2 R l R 2^'l 


IlI 2 ZiZ 2 Ei E 2 Bi 


Y l Y 2 E l E 28 l B 2 B l 


Y 2 L l L 2 z l z 2Q.lQ2 


L 2 R l R 2 w l w 2^lQ'2 


w 2 b 1 b 2 m 1 m 2 T 1 t 2 


b 2 e 1 e 2 l 1 l 2 a 1 a 2 


°2 b 1 b 2 r 1 r 2 y 1 y 2 


11 


12 


13 


14 


15 


QYBBLNX 


NABQBDO 


YMQDLWI 


N A C 0 X C R 


R G A S W Q B 


Wl Y 2 B l B 2 B l 


N -jN 2 A-lA2B-^B 2 Q 1 


V&thtotoPi 


N 1 N 2 A 1 A 2 C 1 C 2°1 


R 1 R 2 G 1 G 2 A 1 A 2 S 1 


B 2 L l E 2 N l N ^Cl Y 2 


Q2 b 1 b 2 b 1 b 2°1°2 


D 2 L 1 L 2 W 1 W 2 L 1 L 2 


O 2 X 1 X 2 C 1 C 2 R 1 R 2 


S2WlW2QlQ,2 B lB2 


16 


17 


18 


19 


20 


F D D T E B A 


MFDETEK 


AKGDFO Q 


D U B N D C L 


Y D V W B A X 


E l F 2 D l B 2 r) l D 2 T l 


M 1 M 2 F 1 E 2 D 1 D 2 E 1 


A 1 A 2 K 1 K 2 G 1 G 2 D 1 


D l D 2 U l U 2Wl 


Y l Y 2 D l D 2 V l V 2 W l 


T 2 E 1 E 2 B 1 B 2 A 1 A 2 


E 2 1 'l T 2 E l E 2 N l N 2 


D 2 F 1^ , 2 0 1 0 2%^2 


N 2 D r D 2 C l C 2 L, l L 2 


W 2 B 1 3 2 A 1 A 2 X 1 X 2 


21 


22 


23 


24 


25 


C A U G G X 0 


AETXXTS 


D A Y X H K 0 


L S X A B R K 


RPUZWHO 


G l B 2 A l A 2 G l G 2 G l 


A l A 2 R l R 2f T l T 2 x l 


b 1 b 2 a 1 a 2 y 1 y 2 X 1 


L 1 L 2 S 1 S?iX 1 X2A 1 


R l R 2 p l p 2 u l u 2 z l 


G 2 G 1 G 2 X 1 X 2°1°2 


X 2 XiX2TiT 2 S 1 S2 


X 2 H 1 H 2 K 1 K 2°1°2 


a 2 b 1 b 2 r 1 r 2 e 1 k 2 


Z 2 w 1 w 2 H 1 H 2°1°2 


26 


27 


28 


29 


30 


HTDHTSG 


MLSLQPO 


UNHCf CK 


K A q B D 0 F 


L E K A P R G 


M 1 M 2 T 1 T 2 D 1 D 2 H 1 


M 1 II 2 L 1 L 2 S 1 S 2 L 1 


U 1 U #1 N 2 H 1 H 2 C 1 


KiK^iA 2 Q,iQ 2 b 1 


l 1 l 2 e 1 e 2 k 1 k 2 a 1 


H 2 T 1 T 2 S 1 S 2 G 1 G 2 


I>2(llQ2PlP2Pl02 


C2lll2ClC2KiK2 


B 2 D 1 D 2 O 1 O 2 F 1 F 2 


A2PlP2RlR2GlG2 


31 


32 


33 


34 


35 


S X U P 0 W A 


LMAVOJL 


MLAXK? W 


STHCXEQ 


V H S I X S L 


S l S 2 X l X 2 U lU2 P l 


L 1 L 2 M 1 M 2 A 1 A 2 V 1 


M 1 M 2 L 1 L 2 A 1 A 2 X I 




V 1 V 2 H 1 H 2 S 1 S 2 I 1 


1 

•g 

0 

rH 

P4 


V 2 QiQ,2 H i H 2 L 1 L 2 


¥l¥lW2 


C 2 X l x 2 K l K 2 Q lQ'2 


I 2 X 1 X 2 S 1 S 2 L 1 L 2 


36 


37 


38 


39 


40 


LIXLXRS 


G Z D F K L N 


Y B X M R B N 


A D K T T B A 


EOBHHL 


L 1 L 2 W 1 W 2 X 1 X 2 L 1 


g 1 g 2 z 1 z 2 d 1 b 2 f 1 


y 1 y 2 b iB2XiX2Mi 


a 1 a 2 d 1 d 2 k 1 k 2 t 1 


E 1 E 2°1°2 B 1 B 2 H 1 


l 2 x 1 x 2 r 1 r 2SiS2 


F 2 K 1 K 2 L 1 L 2 N 1 N 2 


M 2 R 1 R 2 S 1 B 2 N 1 N 2 


T 2 T 1 T 2 B 1 B 2 A 1 A 2 


H 2 V/ 1 W 2 V 1 V 2 L 1 L 2 


a 


42 


43 - 


44 


45 


YSXMBOW 


P G X K 0 R Z 


I U C E A D Y 


IDBLZHI 


T A N H C A I 


Y l Y AW0«l 


VAW*. 


iiWaPiO*. 


I l I 2 D l D 2 B l B 2 L l 


TiT 2 AiA^ 1 N 2 Hi 


^2 b 1 b 2 g 1 b 2^1®2 


K 2 0i02RiR 2 z 1 z 2 


e 2 AiA 2 DiD2Y 1 Y 2 


L 2 z lZ#lM 2 Ill2 


H 2 C 1 C 2 A 1 A 2 I 1 I 2 


46 


47 


48 


49 


50 


D N C I D D 0 


YIBCNOL 


YUUHCEP 


OTDKGBF 


UNAELBD 


B 1 D 2 N 1 N 2 c 1 c 2 I 1 


Y 1 Y 2 I 1 I 2 B 1 B 2 C 1 


Y 1 Y 2 U 1 U 2 U 1 U 2^1 


°1°2 T 1 T 2 D 1 D ^' I 1 


U 1 U 2 N 1 N 2 a 1 a 2 H 1 


i 2 d 1 d 2 d 1 d 2°1°2 


b 2^1®^2 b 1 g 2^11*2 


m 2 c 1 c 2 e 1 e 2 p 1 p 2 


m 2 g 1 g 2 b 1 b 2 e 1 e 2 


h 2 l 1 l 2 b 1 b 2 d 1 d 2 ’ 



FIGURE 82. 
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Figure 82 - Continued. 



51 52 53 54 55 

WXEXKKC S 5 T 0 X T S' DAYXHKC HLDETRHF AY.APMHC 

W^pX^NaXi Pi D^^AtAoY VY 2^t_ IJift^LiLpD^DgKi AjAgY^Y^^AjAgP^ 

3 ^ K l K 2 K l K 2pl c 2 °2 x 1 x 2 t 1 t 2 s 1 s 2 x 2 h 1 h 2 k 1 k 2 c 1 c 2 k 2 r 1 r 2 r 1 r 2 f 1 f 2 . f ^1 m ^ i 1 h 2 c 1 c 2 

56 5? 58 59 ' 6o 

ANMBVGR EZQA'TCY IMNDLRL GMTWETR CVVKTED 

W 1 W 2 J 1 ' WiMWi Wi¥M 

B 2 V 1 V 2 g 1 g 2 r 1 R 2 a 2TiT 2 C 1 C2Y 1 Y2 

61 ’62 * 63 " ‘ 64 65 

UFDEEXH EQ.VCBLY U'DUGYAF HNQLK'IR UCNVDLH 

B 1 G 2 E 1 F 2 B 1 R 2 E 1 F l R 2^1^-2^ 1 y 2 G 1 B 1 G 2 B 1 R 2 B 1 B 2 G 1 R 1 R 2^1^2^1^^ J 1 B 1 B 2 G 1 G /^1 R 2 F 1 

R 2l'll , 2 x l x 2 R l R '2 P2 B 1 B 2^1 B 2^ 1 Y 2 G 2^"l^2 A l A 2 F l F 2 " 1'2 X 1 X 2 F 1 F 2 R 1 R 2 Y 2 B 1 B 2 B 1 B 2 R 1 R 2 

_ _ ________ 

66 , 67 ' ‘ 68 • - 69 70 

LZDRELK' X-KUPSEit CTNKTKE BOEEPGV-, QTGWERH 

Li EnZ-i ZpD-i DqR-i X-i Xpifci KoU-i U pP-. CiCoTiToU'iNoKi B-iBpO-iOpEiEpEi Q-i QpT t T pGi GpW-i 

¥A¥i4 

71 72 73-74 75 

LZDRELK FAX'IYDA KZLXXOR RljERRRR NCIE 

E 1 E 2 E 1 E 2 E 1 B 2 R 1 P ]_P 2 a i a 2 X 1 X 2^ 1 K^EgZ^ZgjLjLgX^ R 1 R 2?1 F ? F 1 R 2 R 1 R 1 R 2 G 1 G 2 

R 2 E 1 E 2 L 1 L 2 K 1 K ?, I 2 Y 1 Y Z D 1 D 2 A 1 A 2 X 2 X l X 2Pl°2 ft l R 2 R 2 R 1 R 2 R 1 R 2 R 1 R 2 I 1 I 2 E 1 E 2 
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B 101 SBUlBBi i 

iQDIIIDDIIDIilllDMIlIQIinil 
■illl IDDIII IIH 
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□□■■ai in ehm ■ ibiuibb 
inai III □■UDOBBI ■■! ■■■■ 
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P II IDD Bill on ■ 
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IllBBnBBBBIK l ■ IBBBIIBBBB 
KmBBBBBBBBBBDLDBBIIBIIIIIBBBDBDB 
■InBDBBBBBBIIBDC aBDBBBBmBBB 




A. BCDEFGHIKLM NOPQRSTUVWXYZ 

U ifllfiHn 1 ^ ii. 7 »1 afc 8 7 »? * <1 u 7 1 } o j- n n ff j 

FIGURE 83. 



Q 8 
R 8 
S 9 
T 11 
U '15 

V 8 
W 7 
X 14 

Y 15 
Z 9 



to a row In tho substitution checkerboard. If the rows belonging to the 
same category can be ascertained a 'large step forward in solution can 
be taken. Why not try to match the distributions in the rows? For 
example y rows D and M appear to be similar: 
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0^ Components 



ABC DEFGHIKLM N 0 P 0 RSTUVWXYZ 



A 

B 

C 

D 

E 

F 

G 

H 
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10 T 
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C 10 
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a 


■ 


m 




H 


■ 


H 


ID 


■ 


EZD 


■ 


i 0 


■ 


n 


n 


■ 


■ 


■ 


m 




■ 


■ 


B 


m 






D 




■ 




■ 


a 


r 


■ 


■ 


□ 


m 


13 


■ 


a 


■ 


D 


a 


■ 


m 




■ 


■ 


■ 


a 




nn 


a 




□ 




a 


a 


m 


■ 


a 


□ 


D 


0 


□ 


■ 


□ 


□ 


□ 


□ 


h 




■ 


■ 


■ 


_ 




m 


n 




■ 




■ 




r 


■ 


■ 


i 


r 


O 






■ 


a 


EJ 


■ 


m 




a 


n 


□ 




“ 










□ 






■ 


■ 


■ 


a 


■ 


0 






□ 


□ 


r 


n 






m 


■ 


fl 


n 




1 








IL 




1 


m 


■ 


a 


□ 


□ 


0 


i 




1 


eh 


& 


■ 






■ 


■ 








— 1 


“ 






□ 






m 


■ 


m 


■ 


■ 


m 


—1 




— i 


a 


m 


D 






■ 


■ 







“i 


a 


■ 




■ 


a 








■ 


m 


a 


■ 


H 




m 


■ 


■ 










■ 


■ 


■ 




1 : 


I 5 


m 


■ 




a 


ai 




T 




■ 


■ 






0 




B 


■ 


■ 










■ 


■ 


B 






K 7 




a 




□ 


a 


■ 






■ 


■ 




n 


H 




■ 


on 


B 


m 




T 




■ 


D 


n 






L 12 


□ 


■ 


m 


■ 


■ 


□ 




1 


■ 


D 


■ 


■ 


0 




■ 


■ 


□ 


on 


■ 


0 


■ 


■ 


a 


□ 




1 


M 12 

N 13 
0 3 

P 4 
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R 5 
S 7 
T 9 
u 15 

V 6 

w 3 

X 10 

Y 13 
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ABCDEFGHIKLM N 0 P Q R S T U V W X Y Z 
q IH il io ii fe 7 9 t 13 ll f J m 6 8 4 «• « 3 «? 40 1 y 



FIGURE 84. 



N = 
22 



N - 
1 1 



FIGURE 85. 

* 

Applying the X-test, the observed value of X = 34i the ejected value Is 
i 23. An excellent match is obtained, and the hypothesis that D 'and 11 are in 

the same row in the checkerboard seems promising. Can any confixmation be 
found in the cryptogram itself? 
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e. It has already been pointed out that this system reduces to 

monoalphabetic substitution with variants. This being the .case it should 

be possible to find manifestations of equivalency between some of the 
®1 

0 2 vertical pairs in the cryptogram. Note the following instances of 

i 

apparent equivalency between and 



Period 16" 


D^i 


D 1 B 2 


Period 18 


G 2$l 


D l$2 


20 ' 


Y^Bi 


D 1 B 2 


- 32 


L 2$l 


m 1«2 , 


49 


T 2 B 1 


D 1 B 2 








2 


*£l 


M 1 B 2 


12 


a 1 B 2 


a 2°1 b 1 d 2 








50 


A H 


AD HD 


16 


F2E1 


d 1 e 2 ' 


- 8. 


a 1 b 2‘ 


AjMi - RjM2 


17 


PjEi 


b 1 e 2 


19 


d x n 2 


D 2°l U 1 D 2 


- 59 


G 2 E 1 


M 1 E 2 


46 


D I 


D D N D 


v 


6 X 


X «c 


44 


D 1 Z 2 


D ^1 B 1 M 2 


3 


Z 2 G 1 


D l G 2 


- 






56 


N G 
2 1 


MG 

12 


43 

\ * 67 


K 2 

12 


UJ3i C X D 


13 


Q^l 


D 1 L 2 








37 

58 


Z £l 

NjLi 


SS . 




V 




• 66 


z 2 l 1 


B 1 E 2 


- 




c 


71 

6 


A2L1 




- 






13 


Wl 


M 1 L 2 


— 






58 




M 1 L 2 








It may be assumed the 


Dj* - and the two distributions in Fig. 8 


amalgamated. 










1 


D 1 + M 1 a_b 


C D E F G H I 


jklmnopoe'stuvwxyz 




: 


S m ^ “ 




* 1 





* 



S 



The only other row in Fig. 83 which gives indications of being similar to 
this distribution is the A ro w. A, soarch is made through the text to see * 
if any equivalence between A-^, D^ and appears. 
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«p 




* 



Note the following cases: 



8 


Y 2 Bi AxB 2 A5M1 


12 


N2B1 AxB 2 A2D1 


50 


N2B1 AxB 2 A 2 Dx 


16 


D2B1 DxB 2 D2A1 


20 


Y 2 Bx DxB 2 D2Ax 


49 


t 2 b 1 D 1 B 2 d 2 f 1 


2 


M 1 B 2 *2*1 


21 


C2®1 a 1 g 2 AjjjXx 


30 


K 2 Gi AxG 2 SxP 2 


3 


Z 2°l Pl^ B 1 K 2 


56 


N2O1 MxG 2 M2Rx 


24 


x 2 K 1 A 1 K 2 R 1 z 2 


34 


T&i MxK 2 M2Q1 


33 


LjjPi A X P 2 A 2 Wx 


48 


U2P1 MxP2 0xM 2 


15 


G^x AxQ 2 A^x 


18 


G2Q1 B1Q2 DxN 2 


32 


L2Q1 MxQ 2 MjHx 


14 


N 2Xl AxX 2 A2Gx 


61 


P 2 Xx DxX 2 D2HX 



57 Q 2 Y 1 a 1 y 2 i 1 d 2 ~ 

72 F 2 Yl A if 2 AaDi 

63 U 2 Yx DiY 2 A 2 A 1 

It certainly seems as though and this will be assumed to be 

\ 

correct. Among the most frequent combinations is the pair Y^^, appearing 

in the following sequences: 

Period 2 Y 2 Cx Yi< 3 2 Y 2 Bx MiB 2 MjjRx 

8 Lift 2 YiW 2 Y 2 Bi AiB 2 A2M1 

10 BxA 2 Yi0 2 Y 2 Bi EiB 2 E2jRl 

20 NxL 2 YiW 2 Y 2 Bi DxB 2 D2Ax 

41 ® L ^2 y 1®®2 y 2®1 ®1®2 ®2®1 

Note how Mx , A]_, E]_, D^, and all appear to be interchangeable. Are 
these the 5 letters which belong in the same row? The probable equivalence 
among Ax, Dx> end Mx has been established by noting cases of equivalency 
in the text. A further search will be made to see if Ex and Sx also show 
equivalencies with Ax, Dx« and Mx> 
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Note the following: 



Period 21 CnG"i At Go 

30 K^I A 1 G 2 

3 Z2°l d 1 g 2 

69 oaG]. E1G2 

56 N2G! MiGa 



23 DnXoDJTi A 1 H 0 

32 A^Ho 

6l D 1 X 2 D 2 HJ E]H 2 



Here are indications that E]_ belongs to the same series, but not enough 

J 

cases where is interchangeable with A, D, E, or M can be found to be 
convincing. But perhaps it is best not to go too fast in these early 
stages. Let it be assumed for the present that A, D, E, and M are in the 
same row of the substitution checkerboard. In period 16 there is the pair 
of vertical components E 2 . Since Dj = Ej_ this pair may be written 
EiE 2 , whereupon the plain-text letter E is immediately indicated. All 
cases of this sort are sought in the” text and the plain-text letters are 
inserted in their proper places, there being 7 such instances in all, but 
these yield the important letters, A, D, and E. 

f. In a similar manner, by an intensive search for cases in which 
components appear to bo equivalorit because they occur in repetitions 
which are identical save for one or two components, it is established that 
C, 6, M, and W are in the same column in the checkerboard. Note the 
bracketing of these letters occurring as 0 2 components in the next to the 
last list of sequences in subparagraph e. Likewise, B, Q; and N are 
established as being in the same row. Again the text is examined for 
cases in which plain-text letters C, 0, M, W, B, H, and N may be inserted. 
By carrying out this process to its full extent possible, the skeletons 
of words will soon begin to appear. 
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/ > 

£. Enough has been'-demonstrated to show this line of attack. Of 
course, if there is a large volume of text at hand, the simplest pro- 
cedure would he to construct frequency distributions of the types shown 
in Figs. 83 and 84 , and use the statistical method to match the individual 
distributions. For this method to be reliable it would be necessary to 
have several hundred letters of text, but this in actual practice would 
not be too much to expect. 

h. There is, however, anothor line of attack, based upon the 
probable-word method. It has been pointed out that in the case of letters 
in odd positions in the periods 40 % of the time the plain-text letter 
involved is indicated by either its 6 ^ or 62 component. This property 
affords a fair basis for assuming a probable word. For example, the 

* 1 

cryptogram here studied shows the following two periods: , 



S - L 

Periods 35 L 1 L 2 W 1 W 2 X 1 X 2 L 1 

and 36 ■^2 X 1 X 2^1®2^'1^'2 L 



YHSIISL LWXLXRS 

Two letters are quite definite, Sp and Lp. Suppose the possible plain-text 
letters bo. indicated. 



Possible plain- fv . H . S . I 

text lotters (i X L 

„ „ fVl V 2 Hi H 2 Si S2 II 

Components •) Ig Xl X 2 S x S 2 L L L 2 



■L, . W . X . L 
X R S 
1*1 L2 Wl W2 XI X2 Ll 
L 2 X X X 2 % r 2 s l S 2 



Cipher text 7HSIXSL LWXLXRS 
The word HOSTILE is suggested by the letters H . S . I L . . This word 
will be assumed to be correct and it will be written out with its components 
under the cipher components. Thus: 
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Plain text 
Cipher-text 
Components 



(Vi V 2 
' ( l2 Xl 



35 

H 0 S T I 
% H 2 Q± S 2 i! 
X 2 Si S 2 Li L 2 



36 " 



L E 



L 1 l 2 
1-2 Xl 



Plain-text 

Components 



( % 0 X Si T x I x Lj. Ej. 

\ % ° 2Sjl!lj L2E2 

This word, if correct, yields the following equivalencies: H 2 r X-? 

— ®i» ®i — 0 2 ; “ S 2 ; Ljl — T 2 ; I 2 — L 2 — j X^ — E 2 > Again the text is 

examined for cases in which the plain-text letters may now be directly 

inserted; but only one case is found, in period 44, where IjL 2 r lil 2 

= Ip. This is unfortunate, so that additional words will have to be 

assumed. The 14th period shows a C^ and the components after it suggest 

that the word CROSSROADS may be present. Thus: 

CRO SSROADS 



Periods N i N 2 Ai A 2 Ci C 2 Oi 

14 and 15 02 Xj X 2 Ci C 2 Ri R 2 

N A C 0 X C R 



Rl R 2 Gi G2 Ai A2 Si 
S2 Wi W 2 Ql 02 Bi B 2 

R G A S W Q B 



Take the first letter Rp, represented by C^R-j^. 
Since Rp - C^R^, 

Therefore, R^R.^ z CjiR^ 

Hence R^ - C 2 and R 2 r Ri 
Therefore , % : R 2 s' C 2 
Again, in the case of the 1st Op, 

°p = °1 r 2 

Bat 0 p - 0^2 = 0 x R 2 
°2 = R 2 

Therefore, R i = R 2 = ° 2 s C 2 
The various equivalencies yielded are as follows: 
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A study of the equivalencies indicated that 

( 1) Dji M belong in the 'Seme row 

(2) N belong in the same row 

(3) R^ S belong in the same row 

(4) 0^ M 1 W belong in the same column 

(3) Ij L belong in the same column 

(6) H belong in the same column 

(7) The coordinates of R are identical and hence this letter 

■ 

occupies a cell along a diagonal sloping from left to right. 

J. Since a row or a column can contain only 5 letters, it is 
obvious that A D E M, BHN, and & R S fall in 3 different rows; C 0 M W 
and I L fall in different columns. A start may be made by an arbitrary 
placement' of R in the position 1-1, and since R-^ ; 0 2 - C 2 : M 2 : W 2 , 
this means that R, 0, C, M, and W form ono column in the substitution 

i 

checkerboard, as shown in Fig. 87* The data also indicate that R, Gl- 
and S must be in row 1, A, D, and E must be 
in row 4, H and X must be in column 3* This 
means that 6^ for A, D, and E must be 4, 
and that 8 2 for H and X must be 3. And since 
= Ig = ®2 for 1 and L must be 4* 

FIGURE 87. Substituting in the text the coordinates for 

1 

the known values, soon additional plain-text words become evident. For 
, example, taking the periods with the word HOSTILE, it becomes 

L E 

L i in w i w 2 x i x 2 h. 

L 2 X 1 X 2 R 1 R 2 S 1 S 2 

L W X L X 'r S 



HOST 1 

Periods V 1 v 2 H 1 H 2 S 1 s 2 Z 1 

35 and 36 Z 2 X 1 ^ S 1 S 2 L 1 L 2 

V H S I X S L 
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XL 
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ft 
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possible to insert the letters Rp and Op as the 2 d and 4 th letters after 
Ep, suggesting that the word after HOSTILE is TROOP. This gives 
W-l X 2 r Tp,- which permits of placing T in position 5“3» Since T in 
HOSTILE z S^, therefore S 2 z 5 and - 3* Since S is in row 1, and 
S 2 ; 5, S must go in position 1-5. Since 1<2 : 4 and Lj s 3, L must go 
in position 3 - 4 . Since 0 p (the 1st 0 in TROOP) z X 1 R 2 and it is known 
that Op - 3 - 1 , therefore X must be in position 3' 3- The checkerboard 
is now as shown in Pig. 88 . Prom Pig. 86 , X^ z E 2 . Now X^ = 3, and 





since the E must be in row 4» it is evident that E must occupy cell 4“3» 
as seen in Pig. 89 . There are now only 2 possible rows for H, either 1 
or 2. It is deemed unnecessary to give further details of the process. 
Suffice it to say that in a few minutes the entire checkerboard is found 
to be as shown in Pig. 90. It will docipher the entire cryptogram as 
it stands , but speculating upon the presence of W U T V Z in the last 
row, and assuming a key-word mixed sequence has brought this about , a 
rearrangement of the columns of the checkerboard is made to give 
T U V W Z, as shown in Pig. 91* The arrangement of the rows now becomes 
quite evident and the original checkerboard is found to be as shown in 
Fig. 92. It seams to be based upon the key phrase XYLOFHDNIC BEDLAM. 
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k. The completely deciphered cryptogram 13 as follows: 
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jL. The stops taken in recovering the original substitution checker- 
board demonstrate that cyclic permutations of a corroct checkerboard will 
serve to decipher such a cryptogram just as well as the original checker- 
board. In other words, a cryptogram prepared according to this method is 
decipherable by factorial 5 (5x4x3x2xl = 120) checkerboards, all 
of which are cyclically equivalent. Even though the identities of the 
components will be different if tho same message is enciphered by two 
different cyclically-equi valent checkerboards, when these components are 
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recombined, they -will yield identical cipher texts, and therefore so far 
'as external appearances are concerned different checkerboards yield 
identical cryptograms. The reason that there are only factorial 5 
cyelically-equi valent checkerboards and not factorial 10, is that what- 
ever permutation is applied to the row coordinates must be the same as 
that applied to the column coordinates in order that the aforesaid re- 
lationship hold true. If two checkerboards have identical row coordinates 
but different column coordinates certain portions of the cryptographic 
text will decipher corroctly, others incorrectly. For this reason, in 
working with cryptograms of this typo the cryptanalyst may successfully 
use a checkerboard which is incorrect in part and corroct it as he pro- 
gresses with the solution. It may also bo added that the actual permuta- 
' tion of digits applied to the side and top of the checkerboard is of no 
. consequence, so long as the permutations are identical. In other words, 
the pormutation 5-2-1- 3-4 will work just as ’.veil as 3-2-4-I-5, or 
1-2- 3~4 _ 5i etc., so long as the same permutation is used for both row and 
column coordinates. It is the order of the rows and columns in the 
checkerboard which is the determining element in this system. Any 
arrangement {of the letters within the checkerboard) which retains the 
original order as regards the letters within rows and columns will work 
just as well as the original checkerboard. 

m, A final remark may be worth adding. Aftor all, the security of 
cryptograms enciphered by the bifid fractionating method rests upon the 
secrecy inherent in a single mixed alphabet. In ordinary substitution, 
a single mixed alphabet hardly provides any security at all. Why does 
the bifid system, which also uses only a single mixed alphabet, yield so 
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much higher a degree of security? Is it because of the transpositional 
# 

features involved? Thinking about- this point gives a ‘negative answer, 
for after all, finding the length of the periods and replacing the 
cryptographic text by components based upon the cipher letters is a 
relatively easy matter. The transpositional features are really in- 
significant. No, the answer to the question lies m a different direction 
and may bo suramod up about as follows. In solving a simplo mixed-alphabot 
substitution cipher one can attack a few cipher letters (the ones of 
greatest frequency) and find their-equivalonts, yielding fragments of 
good plain text here and there m the cipher text. Once a few values have 
been established m this manner, say 6 values, the remaining 20 values 
can be found almost from- the context alono. And in establishing these 6 
values, the letters involved, are not so interrolatod that all 6 have to be 

t 

ascertained simultaneously. The cryptanalyst may establish the valuos one 
at a time . But m the case of the bifid system the equivalents of the 
plain-text letters are so interrelated that the cryptanalyst is forced to 
ostablish the positions of several letters in the checkerboard simultane- 
ously, not one by one. In other words, to uso an analogy which may be 
only partially justified, the solution of a simple monoalphabetic substi- 
tution cipher is somewhat like forcing one’s way into an inner chamber 
which has a number of doors each having a single lock; the solution of a 
bifid fractionated cipher is somewhat like getting into a vault — there 

is only one door which is provided with a complex 5-combination lock and 

/ 

all the tumblers of the lock must bo positioned correctly simultaneously 

{ 

before the releasing lever can drop into the slot and the door opened. 
Fundamentally, this principle is responsible for the very much greater 
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security of the bifid systan as compared with that afforded by the 3imple 
monoalphabetic system. It is a principle well worth remembering and 
speculating upon. 

48. Special solutions for bifid systems, - ja. The security Of the 

bifid system is very considerably reduced if the situation in which_.it is 

employed happens to be such that two or more messages with identical 

, 

beginnings, endings, or internal portions can often be expectod to occur, 

1 • 1 

1 < 

For in this case it is possible to establish equivalencies between com- 
ponents and quickly reconstruct tho substitution checkerboard. An example 
will be given to illustrate tho steps in a specific caso, 

_b. Here arc two cryptograms transmitted by two coordinate units to 
a superior headquarters at about the same time. They show certain 
identities, Which havo boon underlined. 

1. QJTBHL Ymm QHDOY EON DW VU YTE MHft ZD QTLKE MX £SLIP QDWC 

2. VEN HY XD ABG- DOIHO BNtfVL YTF WH QX DQV LKEWW AXDQS ABCAK XGX 

c_. Apparently these two cryptograms contain almost identical texts. 

In order to bring tho identitios into the form of superimposed components, 
it is necessary to transcribe tho texts into periods of 7 and to super- 
impose the two messages as shown in Fig.- 93. 

d. Tho shifting of tho 2d cryptogram 2 intervals to tho right brings 
about the superimposition of the majority of 0^ and 02 components and it may 
be assumed that for the most part the texts dre identical. Allowing for 
slight differences at the beginnings and ends of the two messages, suppose 

a table of equivalencies is drawn up, beginning with the 8th superimposed 
N x N 2 N 2 Hi 

pairs. Thus, <J 2 = honce Q 2 = r D z ; honce N 2 = and ; D 2 . 

Going through the text m this manner and terminating with the 42d super- 
imposed pairs, the results arc tabulated as shown in. Fig. 94* 
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1234567 


8 9 10 11 12 13 14 


15 16 17 18 19 20 21 


22 23 24 25 26 27 28 


Qi q 2 Vi v 2 Bi b 2 Bi 
b 2 Li l 2 Yi y 2 Xi x 2 
0 v B B L Y X 


Ni w 2 Ai A 2 Bi B 2 Qi 

02 B 1 B 2 D 1 D 2 °1 °2 
N A B Q B D 0 


Yi y 2 Hi h 2 Oi o 2 Ni 
n 2 Di d 2 Wi w 2 Vi v 2 

Y H 0 N D W V 


Ui U 2 Yi Y 2 Ti T 2 Ei 
e 2 Mi m 2 Hi h 2 Qi q 2 

U Y T E ,M H Q 



Vi V 2 Bi B2 Ni N2 Hi 
H 2 Yjl Y 2 X x X 2 Di d3 



V 3 N H Y 'X D 



Ai A2 Bi B 2 Gi G 2 Bi 



Be 



B 1 

B 



D 2 O x 0 2 Ii 
G B D 0 



Hi H2 Oi O2 Bi B2 Ni 
N 2 ft’i w 2 V 2 V 2 Li L 2 
H 0 B N W V L 



Yi Y2 Ti T 2 F 1 
W 2 % H 2 Qi 0 2 
Y T F W H 



29 30 31 32 33 34 35 


36 37 38 39 40 41 42 


43 44 45 46 47 48 49 


Zi z 2 Di d 2 Qi q 2 Ti 

t 2 l 1 l 2 k 1 k 2 E 1 e 2 
Z D Q T L K E 


E l E 2 W 1 w 2 A 1 a 2 P 1 

p 2 k x k 2 Qi q 2 Si s 2 

E W A P K Q S 


L 1 l 2 I 1 I 2 P 1 - P 2 Ql 

°»2 D 1 D 2 W 1 w 2 C 1 c 2 
L I P Q D W C 



F 2 Wi 
Xi X 2 

a X 



D 1 D 2 0.1 02 V 1 v 2 L 1 
L 2 K 1 K 2 e 1 e 2 W 1 w 2j 



V L K E W 



Wl W 2 A l A 2 Xi X 2 Di 
D 2 Qi Q 2 Si S 2 Ai a 2 
WA X D Q S A 



B 1 b 2 C 1 c 2 A 1 a 2 n 1 
N 2 Xi X 2 Gi G 2 Xi X 2 
B C A K X G X 



FIGURE 93. 



®l®2 • • = ABCDEFGHIKLMNOPQRSTUV'WXYZ 
D 2 0.2 E l Ei N 2 N 2 W 2 E 2 'L 2 ^2 Xi Vi B 2 Tl Z 2 T 2 G2 E 2 

*2 12 V 2 X 2 Bi Pi 

Nl U 2 



e 2 0 i •• = abcdefghik'lmnqpq.rstuvwxyz 
Ui Bi Li Zi Yi Di D 2 Ml W 2 Ni Di Xi Ni Ei M 2 Li Bi Wi 

N 2 Hi Ki 

- K 2 II 

Dg 



FIGURE 94. 

e^. From these equivalencies it is possible to reconstruct, if not 
the entirely, then at least a portion of the substitution checkerboard. 
For example, the data show that N, H, and I belong in the same row, E and 
F belong in the 3ame row, N and K belong in the same column, and so on. 
Experimentation to make all the data fit one checkerboard would sooner or 
later result in reconstructing the checkerboard shown m Fig. 92, and the 
two messages read as follows: 

1. SEVENTH INFANTRY IN POSITION TO ATTACK AT FOUR AM PLAN FOUR. 

2. TENTH INFANTRY IN POSITION TO ATTACK AT FOUR AM PLAN THEEEX. 
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f. Tlie foregoing gives a clue to what would happen in the case of an 
extensive traffic in which long phrases or entire sentences may be ex- 
pected to occur repeatedly. By a proper indexing of all the material, 
identical sequences would bo uncovered and these, attacked along the lines 
indicated, would soon result in reconstructing the checkerboard, where- 
upon all the messages may be read with eaBe, 

49. Solution of trifid systems. - a. In the trifid fractionating 
system the cipher alphabet is tripartite in nature, that is, the plain- 
text letters arc represented by permutations of 3 c ompo.no nts taken in 
groups of 3*8, thus forming a set of 27 equivalents, such as that shown 
below: 



A = 111 J = 211 S z 311 

B = 112 K = 212 T = 312 

C = 113 L z 213 U = 313 

D = 121 M = 221 V = 321 

E = 122 N =222 Vs 322 
F = 123 0 = 223 X = 323 

G = 131 P = 231 Y = 331 

H z 132 Q z 232 Z z 332 

I : 133 R z 233 ? = 333 

b. The equivalents may, of course, be arranged in a mixed order, 
and it is possible to use one tripartite alphabet for decomposition and a 
wholly different one for recomposition. One disadvantage of such an 



alphabet is that it is a 27-eloment alphabet and therefore some subter- 
fuge must bo adopted as regards the 27th element, such as that illustrated 
in the footnote to Par. 57 of Special Text No. 166, Advanced Military 
Cryptography, wherein ZA stands for Z and ZB for the 27th character. 

c. The various types of fractionation possible in bifid systems are 
also adaptable in trifid systems. For example, using the alphabet shown 
above for recomposition as well as decomposition the encipherment of a 



message in periods of 5 is as follows: 
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RELIEIO 
2 1 2.1 1 1.2 
3 2.1 3 2.2 2 
3.2 3 3.2 3. 3 
K A Q H 0 R R 



EYODRRE 
1 3 2.3 2 2.1 
2 3.2 1 3.3 2 
3.1 3 3-3 3 2 

huilxiz 



G1UERTT OMQRROW 
1 1 2.1 2 3.3 2 2 2.2 2 2.3 
3 3.2 2 2.1 1 2 2.2 3 3.2 2 
1.3 1 2.2 2 2 3-1 3 3-3 3 2 
B!?»ATH NN1R0IZ 



Cryptogram ... K A Q, H 0 RRHWF LXIZA BFZBM A TBMH WROIZ 

> ' 



d. The solution of a single cryptogram of this nature would be a 
quite difficult matter, especially if there were nothing upon which to make 
assumptions for probable words. But a whole series of cryptograms could 
be solved, following in general the procedure outlined m the case of the 
bifid system, although the solution is, admittedly, much more complicated. 
The first step is to ascertain the length of the period, and when this 
has been done, transcribe the cipher text into components, which in their 
vertical combinations then represent monoalphabetic equivalents, with of 
course many variants for each letter of' the plain text. Then a study is 
made to establi'sh component equivalents, just as in the bifid system.- If 
the text is replete with repetitions, or if a long word or a short* phrase 
may be assumod to be present, a start may be made and once this sort of 
entering wedge has been forced into the structure, its furthor disinte- 
gration and ultimate comploto demolition is only a matter of time and 
patience. 






« 



50. Concluding remarks on fractionating systems. - a. It goes with- 
out saying that the basic principles of fractionation in the bifid and 
-trifid systoms are susceptible to a great deal of variation and complica- 
tion. For example, instead of having periods of fixed length through the 

xi 

message, it is possible to vary the length of the, periods according to 
some simple or complex koy suitable for this purposo. Or, the bifid and 
trifid systems may be combined into a single scheme, enciphering a text by 
the bifid method and then reenciphoring the cipher text by the trifid method. 
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and so on. Systems of this sort may become so complex as to defy 
analysis, especially if the keys are constantly and frequently varied so 
that no great amount of traffic accumulates in any single key. Fortunately 
for the cryptanalyst, however, such complex systems as these, if intro- 
duced into actual usage, are attended by so many difficulties in practice 
that the enemy cryptographic service would certainly break down and it 
would not be long before requests for repetition, the transmission of 
the same cryptogram in different keys, and so on would afford cluos to 
solution. Could such systems bo employed successfully in field service 
there is no doubt that from tho standpoint of security, the cryptograms 
would be theoretically secure. But tho danger of orror and the slowness 
with which they could bo operated by the usual cryptographic clerks arc 

r 

such that systems of this complexity can hardly bo employed m the field, 
and therefore the cryptanalyst may not expect to encounter them. 

b. However, the simple bifid system, the ADFGVX> system and the like 
are indeed practicable for field use, have boen used with success in tho 
past, and may bo expected to bo in use in the future. It is therefore 
advisable that tho student become thoroughly familiar with tho basic 
principles of their solution and practice the application of these pnn- N, 
ciples as frequently as possible. In this connection, the attention of 
the student is directed to the fact that there is theoretically no reason 
why the bipartite components of the ADFGVX system cannot be recombined by 
means of the some or a different checkerboard, thus reducing the crypto- 
graphic text to a form wherein it consists of 25 different letters, and 
at the some time cutting the length of the messages in half. Tho matter 
is puroly ono of practicability: it adds one more stop to the process. 



REF ID : A56913 



But it must not be overlooked that this additional step would add a good 
deal of strength to the system, for it would shorten, mask, distort, or 
entirely eliminate similar beginnings and similar endings — the two most 
fruitful sources of attack on this system. 

51 * Concluding remarks, on transposition systems. - a. Simple trans- 
position systems hardly afford any security at all, complex ones may in 
the case of individual or single messages afford a high degree of security. 
But just as soon as many cryptograms in the same key are transmitted the 
chances of finding two or more cryptograms of identical length become 
quite good and the general solution may be applied. 

" b. Contrary to the situation in the case of substitution, in that 

/ 

of transposition wherein the lottors of the plain-text itself are 
transposed (not code) tho short or "the cryptogram the groator the possi- 
bility of solution. For, in the case of a message of say only 25 or 30 
letters, one might shift the letters about and actually reconstruct the 
plain text as one does in the case of the game called "anagrams." Of 

l 

course, several different "solutions" may thus bo obtained, but having 
such "solutions" it may bo possible to reconstruct the system upon which 
the transposition was based and thus "prove" one of tho solutions. 

c. The text has confined itself almost entirely to cases of uni- 
literal transposition, in order to demonstrate basic principles. But 
there is inherently no reason why transposition may not be applied to 
digraphs, trigraphs, or totragraphs. If longer sequences are used as the 
units of transposition tho security decreases very sharply, as in the 
case of the ordinary route ciphers of tho Civil War period. 

d. Transposition designs, diagrams, or patterns are susceptible of 
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yielding cryptograms of good security, if they are at all irregular or 
provide for nulls and blank spaces. Such devices are particularly , 
difficult to solve if frequently changed. 

e. Transpositions effected upon fixed-length sequences of plain 

' 

text yield a low degree of security but when a transposition is applied 

1 

y 

to the cipher text resulting from a good substitution system or to the 
code text of cryptograms first encoded by moans of an extensive codebook 
the increase in the cryptographic security of such cryptograms is quite 

t 

notable. In fact, transposition methods and designs are frequently used 
to "supor encipher” substitution toxt or code and play a very important 
role in this field. Their great disadvantage is that inheront in all 
transposition methods: tho addition or dclotion of a smglo letter or two 
often makes tho entire cryptogram unreadable ovon with tho correct key. 

f. Tho clues afforded by messages with similar beginnings, ondings, 
or internal portions, and by repetitions* of incorrectly enciphered mes- 
sages without paraphrasing the original text ore often sufficient to 

! 1 ' l 

c 9 make a solution poosible or to facilitate a solution. For this reason 

\ 

* 

tho cryptanalyst should note all cases wherein clues of this sort may be 

\ 

applicable and be prepared to take full advantage of them. 

; h 

£. Following out the scheme initiatod in the -first text, an 
analytical key applicable to tho subject-matter in this text will bo 
found on page 218 . 



- 217 - 



L 




507-Uni- 508-poly- 509-Bifid, 510-Bipertlte 



literal 

systems 



literal 

systems 




trifid, 

polyfid 

systems 

(Ml- 50 ) 



substitution 
with columnar 
transposition 
ADFGVX system 

( 37 - 43 ) 



511-Mono- 
alpha- 
hetlc with 
transposi- 
tion (35) 



512-Foly- 

alphahetic 
with trans- 
position 
( 36 ) 



617-Geo- 
metric 
designs 
and pat- * 
terns 
(5, 30-34) 



6l8— Colum— 

nar trans- 
position 
methods 
(6-16) 



6l9-Other 



620-Kegular- 



methods length 

(4, 30) groupings 

Mi seel- (Digraphs, 

laneous trigraphs, 

methods polygraphs) 

such as re- (5) 

versed writing, 
rail-fence writing, etc. (4) 



621-Irregular- 
length group- 
ings (Word 
lengths) 

(Id) 



719-Boutb systems 720-GriT.le systems 721-bis*. 722-Incomplete- 
(5) (30-34) (50) ly filled 

rectangles 

(12-16) 



723-Comple tely- 
filled rec- 
tangles (6-11) 



817-Pixed 

(30-33) 

| 

905-One position 
(30) 



818-Index inite 

(34) 

906-Multiple positions 

(31-33) 






REF ID : A56913 

INDEX 

Page 

ADFGVX system 114 

General solution of 148 

Alternation o'f components 159 

Basic principles 149 

Pinal components ....'. 149 

Illustration of solution 156 

Initial components 149 

Minus alternation 163 

Plus alternation 164 

Special solution of 115 

Exact-factor method of solution 145 

Solution by means of identical beginnings 123 

Solution by means of identical endings 116 

Alternation of components 159 

Analytical key 218 

Ascertaining period in bifid system 188 

Bifid fractionating system: 

Ascertaining of period 188 

Basic steps of ► 178 

Bipartite equivalents of 179 

Column coordinate 182 

Even-length periods 179 

General principles underlying solution 179 

Illustration of solution 192 

Matching of distributions 196 

Odd-langth periods 180 

Periods of fixed length 17$ 

Preparation of index 19° 

Probability of occurrence of even-positioned letters 186 

Probability of occurrence of odd-positionod letters 186 

Probable-word method of attack 201 

Reconstruction of original substitution checkerboard 204 

Bov/ coordinate 182 

Security of 209 

Solution of 173 

Special solution of 211 

Vortical pairs of components 183 

Bipartite equivalents 179 

Columnar transposition ciphers: 

Completely-filled rectangles 8 

Column and row transposition .' 10 

Consonants and vowels, deviation of 16 

Invariable digraph 21 

Limited aff mi ty 22 

Obligatory sequences 21 

Pilot letters a 22 

Prpbable method of solution 19 

Reconstruction of litoral key 24 



REF ID-:A56913 

* j- - 

P““ Si ^ *-a 

Page 

Columnar transposition ciphers: (continued) 

Incompletely-filled 'rectangles 1 . . • . v. • '. 28 

Alternative 'Method of solution . . . , . 39 

Formula for 'crfl dilating ‘length and number of long and 

shdrt columns' •. 29 

General principles" underlying’ solution 28 

General solution •••'• 52 s 

Long cblumns of 29 

Master diagram .'. ....... 31 

Short columns’ of 29 ^ 

Special solution of ....... .7.. •••■,. 51 

Width 29 

Special solutions 55 

Cryptograms of identical length ih same 'key * . • 71 

Interchanged paitf of columns 59 

Messages with similar beginnirgs 6l 

Messages vlth similar endings 65 

Omitted col umn 57 

Single massage containing a long repetition 69 

Stereotyped phraseology 55 

r- 1 % 1 

Combined substitution-transposition systems: 

Using digraphic substitution - 113 

Using fractionatihg systems ......’. ......'. ....... 113 

Using known alphabets 110 

Using monoalphabetic' Substitution 109 * 

Using polyalphabcti'c- or polygraphic substitution ..." 112 

Camplctoly- filled root angles ....... •' * 8 

S' » « * 

Doublo transposition' ciphers: ' ‘ ® 

Depth of rectangle a multiple of width 89 

Enciphoring rectangle a perfect square 86 

Failure to oxccUtOr double transposition properly &5 

Spocial cases of solution •••• 85 

Width of rectanglo a multiple of depth 87 

• * - 

Exact-factor method of sblving ADFGVX cipher ,r 145 

* ' * i r r *• 1 ' 

Fractionating 'systesfts:' • 

ADFG9X 114 

Bifid 178 

Concluding remarks on 214 

.Trifid 213 

* . # 1 1 1 

Grilles, indefinite or continuous '. 105 « 

Grilles, revolving 94 

Alpha method- - .' 94 

Beta method ....’ 94 ; 

Principle of exclusion ................ 99 

Principle of sequence 99 

Principle of symmetry 95 



- 220 - 



REF ID : A56913 



Page 

Inscription 5 

Invariable digraph 21 

Matching distributions 196 

Monophase transposition 5 

Obligatory sequences 21 

Pilot letters 22 

Polyphase transposition 5 

Processes, rescriptive ' 5 

Rail-fence writing 6 

Rcscription, process of 5 

Reversed writing 6 

Single transposition 5 

Transcription 5 

Transposition: 

Columnar 8 

Double 78 

Monophase 5 

Polyphase 5 

Simple types of 6 

Single 5 

Uniliteral route 7 

Vertical writing 6 

Trifid fractionating system, solution of 213 

Uniliteral transposition 7 

Vertical writing 6 



